Escape backslash logstash configuration

Elastic Stack Logstash
#1

Hi,

I'm experiencing some troubles trying to split a string using backslash with the split plugin.

XXX\YYY

I'd like to use split => ["field","\"]

Quickly ran into escape problems as expected, according to the documentation i have tried to use the config.support_escapes: true and ["\\"] but this dosen't really help as it looks like i'm escaping the double quotes and not the actual backslash.

Am i missing something ?

#2

In a logstash configuration you cannot have a backslash at the end of a quoted string, it is always interpreted as escaping the quote.

In cases where a regexp is used, you can use a character group that contains a single backslash -- "[\\]"

If you want to do a split I think you will have to call a ruby filter.

ruby { code => 'event.set("field", event.get("field").split("\"))' }
1 Like
#3

Hi,

Thanks for your reply, i had thought about using ruby but was concerned about performance, i managed to find a solution combining gsub and split plugins.

I frankly dont know what's the best for less performance impact one ruby or gsub and split.