# How to drop "

**URL:** https://discuss.elastic.co/t/how-to-drop/135410
**Category:** Logstash
**Created:** [June 11, 2018, 5:39pm UTC](https://discuss.elastic.co/t/how-to-drop/135410 "2018-06-11T17:39:33Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![sysdradmin](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@sysdradmin](https://discuss.elastic.co/u/sysdradmin)
#### Post date: [June 11, 2018, 5:39pm UTC](https://discuss.elastic.co/t/how-to-drop/135410/1 "2018-06-11T17:39:34Z")

</div>

hello,  
We have an error when parsing with logstash :

/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] csv - Error parsing csv {:field=\>"message", :source=\>"6 ...., hello "word",,,,,,,,,,,,, " :exception=\>#\<CSV::MalformedCSVError: Illegal quoting in line 1.\>}

and in fact it's =\> " in csv files which do error

how we can say to logstash to take field anyway ?

thanks

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2018, 6:00pm UTC](https://discuss.elastic.co/t/how-to-drop/135410/2 "2018-06-11T18:00:08Z")

</div>

> [@sysdradmin](#):
>
> how we can say to logstash to take field anyway ?

You can use a drop {} filter to discard an event.

You might be able to set quote char on the csv filter to avoid the problem.

---

<div class="post-metadata">

### Author: ![sysdradmin](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@sysdradmin](https://discuss.elastic.co/u/sysdradmin)
#### Post date: [June 11, 2018, 6:05pm UTC](https://discuss.elastic.co/t/how-to-drop/135410/3 "2018-06-11T18:05:43Z")

</div>

thks for reply

quote\_char in filter :

quote\_char =\> """

=\> don't work and i don't want to drop it !

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2018, 6:11pm UTC](https://discuss.elastic.co/t/how-to-drop/135410/4 "2018-06-11T18:11:55Z")

</div>

> [@sysdradmin](#):
>
> i don't want to drop it

OK, so what did you mean by "to take field away"?

The quote char has to surround the entire field if it contains a comma. If your files do not use a quote char then you could set it to something that does not occur in the file. For example, the lines probably do not contain NUL, so you could use this...

```
 quote_char => '\x00'

```

---

<div class="post-metadata">

### Author: ![sysdradmin](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@sysdradmin](https://discuss.elastic.co/u/sysdradmin)
#### Post date: [June 11, 2018, 6:26pm UTC](https://discuss.elastic.co/t/how-to-drop/135410/5 "2018-06-11T18:26:55Z")

</div>

thanks a lot !  
it's seems working..

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2018, 6:27pm UTC](https://discuss.elastic.co/t/how-to-drop/135410/6 "2018-07-09T18:27:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.