Filter dissect: mapping on double quotes

Elastic Stack Logstash
1

Hi *,

im currently trying to get along with the dissect filter.
So i have the following example log which i try to parse with dissect:

"a b" 33 c

And my dissect mapping looks like this
mapping => { "message" => ""%{f1}" %{f2} %{f3}" }

What i'm trying to do is to get everything between double quotes in one field (f1).
Are double quotes valid to be used within the mapping part as a delimiter? If yes, how do i implement it?

Kind regards
alex

2

I'm not familiar with the dissect filter, but perhaps you'll have better luck with this:

mapping => { "message" => '"%{f1}" %{f2} %{f3}' }
3

Hi,

Had the same issue :sweat_smile: and using single quotes did the trick :wink:

Best regards,

Charles.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.