Grok QS includes quotes, how can I remove them?

Elastic Stack Logstash
1

I'm using the QS grok pattern. It includes the encapsulating quotes in the values.

For example, I'm using it to get the referrer in a custom apache log.

How can I remove the quotes before shipping over to elasticsearch?

"agent" => ""Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.4) Gecko/20100614 Ubuntu/10.04 (lucid) Firefox/3.6.4"",

2

yup that is the problem using %{QA:agent} annoying isn't it

I use "%{DATA:agent}"

though you could always use mutate with gsub to search and replace quotes

the only other option for you is to rewrite the QS defination not to capture the "'s but never found a good answer on that

2 Likes
3

The mutate filter's gsub option can be used to remove the quotes.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.