Gsub remplace double double ("") quotes by space

Elastic Stack Logstash
1

I use the csv filter but some field are like that :
""toto toto" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504"

The csv filter can't parse fields if there is more that 2 double quotes in the field. That is why I want to remplace only the two double quotes at the beegining by a space. I tyed this but it didn't worked :
gsub => ["message"," \ " \ "," "]

I know that I can remplace all double quotes by space but I only want to remplace two double quotes

2

I don't understand the general purpose of those quotes. But wasn't the filter above meant to look like this?
gsub => ["message","\"\""," "]

3

Yes you are right. I tried with your filter but the result is the same. It didn't remplace the "" with a space so I get the same csv error because of more that 2 double quotes in the same field. It wroks if I put this filter

gsub => ["message","\""," "]

to remplace all double quotes but I realy want to keep the other couple of double quote because some times the content of the second double quotes couple contains a comma and comma is my separator for the csv filter. So if the comma is between quotes it is unrecognized as separator and that's exactly what I want. That's why I only want to remplace the double double quotes. I hope it is possible.

4

I tried the filter and it replaces "" with a space. But I think you don't actually want to replace two consecutive quotes? Could you give an example of an input and the desired output string?

5

Yes I want to remplace two consequetive quotes. This is an input for example :

""toto toto" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504"

And this is the output I want :

toto toto" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504"

6

I had executed the following test:

 mutate { add_field => {"msg" => '""toto toto" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504"'}}
 mutate { gsub => ["msg","\"\""," "] }

and got

"msg" => " toto toto\" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504\"",

That looks right to me.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.