How to write quotes and double quotes in the same String


Hello, I want to use the file output. The problem is that my String that I want to write in the output file contains quotes and double quote. I want to write this line :

{"script": {"source": "ctx._source['Categorie SVI'] = '%{Categorie SVI}'","lang": "painless"},"query": {"term": {"ID Appel SVI.keyword": "%{ID Appel SVI}"}}}

There is my configuration :

file {
path => "C:\Users\rtert\Documents\ElasticSearch/sortieSVI.txt"
codec => line { format => '{"script": {"source": "ctx._source['Categorie SVI'] = '%{Categorie SVI}'","lang": "painless"},"query": {"term": {"ID Appel SVI.keyword": "%{ID Appel SVI}"}}}'}

I think problem is that when logstash meet the first simple quote before Categorie SVI it think that it is the end of my string.

YOu can see that with my text editor.


Have you tried to escape quotes ?

Like this :

file {
path => "C:\Users\rtert\Documents\ElasticSearch/sortieSVI.txt"
codec => line { format => '{"script": {"source": "ctx._source[\'Categorie SVI\'] = \'%{Categorie SVI}\'","lang": "painless"},"query": {"term": {"ID Appel SVI.keyword": "%{ID Appel SVI}"}}}'}


Thank you for your answer but if I try your proposal I got this error :


I think it is because of the "&gt". I tried to remplace "&gt" by ">" and the error disapeared but the result was not the good one. In the output file it was written " \ ' " instead of " ' ".


You can try to format your entries with the json_encode filter :

filter {
  json_encode {
    add_field => { "categorie_svi_field" => "ctx._source['Categorie SVI'] = '%{Categorie SVI}'" }

file {
  path => "C:\Users\rtert\Documents\ElasticSearch/sortieSVI.txt"
  codec => line {
    format => '{
      "script": {
        "source": "%{categorie_svi_field}",
        "lang": "painless"
      "query": {
         "term": { "ID Appel SVI.keyword" : "%{ID Appel SVI}" }



I don't have the json_encode plugin installed so I tried with a basic

and it works !

Thank you.


Happy to have been able to help, I'm a novice too :wink:

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.