How to drop "

Elastic Stack Logstash
1

hello,
We have an error when parsing with logstash :

/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] csv - Error parsing csv {:field=>"message", :source=>"6 ...., hello "word",,,,,,,,,,,,, " :exception=>#<CSV::MalformedCSVError: Illegal quoting in line 1.>}

and in fact it's => " in csv files which do error

how we can say to logstash to take field anyway ?

thanks

2

You can use a drop {} filter to discard an event.

You might be able to set quote char on the csv filter to avoid the problem.

3

thks for reply

quote_char in filter :

quote_char => """

=> don't work and i don't want to drop it !

4

OK, so what did you mean by "to take field away"?

The quote char has to surround the entire field if it contains a comma. If your files do not use a quote char then you could set it to something that does not occur in the file. For example, the lines probably do not contain NUL, so you could use this...

 quote_char => '\x00'
5

thanks a lot !
it's seems working..

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.