How to drop a line if it does not have all fields in it?

Elastic Stack Logstash
1

Hi Experts,

I have csv file and it has 4 columns , unfortunately it has data like
"abc", "123", "res","vg"
"abc", "123", "res","vg"
"abc", "123", "res
"abc", "123", "res
"abc", "123", "res","vg"
"abc", "123", "res","vg"

Now everything works fine with csv filter but problem is with line number 3 and 4

  1. it does not have all 4 fields
  2. Line is ending with "res

I want to drop all the lines which ends with "res , please suggest how I can achieve this

I tried following methods but getting same

if [message] == '"res\n'
{
drop { }
}


if [message] == 'res\n'
    {
    drop { }
    }

if [message] == '("res\n)'
{
drop { }
}

**In both the Cases Error is same **

:exception=>#<CSV::MalformedCSVError: Unclosed quoted field on line 1.>

`

Regards
VG

2

Anyone ?

4

Hi Vikas

can you give the total config file?

Thanks

5

Never mind below works like a charm

if [message] == "res/\n"
{
drop {}

}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.