How to remove quotation marks

Elastic Stack Logstash
1

Hi,

the logs I am trying to parse contain some fields in quotation marks:

2016-11-01 00:27:17.034 "157.55.39.145" - ....

What I am trying is the following:

grok {
  match => { "message" => "\A%{TIMESTAMP_ISO8601:eventtime} %{QUOTEDSTRING:c-IP-QS}...
  match => { "c-IP-QS" => """%{IPORHOST:c-IP}""" }

I tried several ways to escape the quotation marks, without success.

'"
"\"
"""

How do I get rid of them?

Thanks a lot!

2

Need to finish testing, but this looks like the solution: https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.