How to escape the double quotes and \r of csv field from longstash

Elastic Stack Logstash
1

My csv data is like this:
S2_CR_Browse_iPhone_T22_Click “Cruise&Stay" link from cruise menu,1393,101,46
Error in Logstash command:
<CSV::MalformedCSVError:[Illegal quoting in line 1.>

My Logstash Filter section:
filter {
if([message]=~"sampler_label" or [message]=~"TOTAL")
{
drop{}
}else{
csv {
columns => ["label"]
skip_empty_columns => true
}
}
}

1 Like
2

@AnantPatil,

Your input string is illegal CSV format. From the CSV RFC:

Fields containing line breaks (CRLF), double quotes, and commas
should be enclosed in double-quotes.

However, as a (hacky) workaround, you could disable the quoting behavior by setting the quote string to some character such as $ that is not expected to be found in your input.

  csv {
      columns => ["label", "num1", "num2", "num3"]
      skip_empty_columns => true
      quote_char => "$"
  }
3

Thank you,will try,