Escape backslash logstash configuration

Hi,

I'm experiencing some troubles trying to split a string using backslash with the split plugin.

XXX\YYY

I'd like to use split => ["field","\"]

Quickly ran into escape problems as expected, according to the documentation i have tried to use the config.support_escapes: true and ["\\"] but this dosen't really help as it looks like i'm escaping the double quotes and not the actual backslash.

Am i missing something ?

In a logstash configuration you cannot have a backslash at the end of a quoted string, it is always interpreted as escaping the quote.

In cases where a regexp is used, you can use a character group that contains a single backslash -- "[\\]"

If you want to do a split I think you will have to call a ruby filter.

ruby { code => 'event.set("field", event.get("field").split("\"))' }
1 Like

Hi,

Thanks for your reply, i had thought about using ruby but was concerned about performance, i managed to find a solution combining gsub and split plugins.

I frankly dont know what's the best for less performance impact one ruby or gsub and split.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.