How to remove quotation marks


the logs I am trying to parse contain some fields in quotation marks:

2016-11-01 00:27:17.034 "" - ....

What I am trying is the following:

grok {
  match => { "message" => "\A%{TIMESTAMP_ISO8601:eventtime} %{QUOTEDSTRING:c-IP-QS}...
  match => { "c-IP-QS" => """%{IPORHOST:c-IP}""" }

I tried several ways to escape the quotation marks, without success.


How do I get rid of them?

Thanks a lot!

Need to finish testing, but this looks like the solution:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.