How to write quotes and double quotes in the same String

[Pierre2]

Hello, I want to use the file output. The problem is that my String that I want to write in the output file contains quotes and double quote. I want to write this line :

{"script": {"source": "ctx._source['Categorie SVI'] = '%{Categorie SVI}'","lang": "painless"},"query": {"term": {"ID Appel SVI.keyword": "%{ID Appel SVI}"}}}

There is my configuration :

file {
path => "C:\Users\rtert\Documents\Elasticsearch/sortieSVI.txt"
codec => line { format => '{"script": {"source": "ctx._source['Categorie SVI'] = '%{Categorie SVI}'","lang": "painless"},"query": {"term": {"ID Appel SVI.keyword": "%{ID Appel SVI}"}}}'}
}

I think problem is that when logstash meet the first simple quote before Categorie SVI it think that it is the end of my string.

YOu can see that with my text editor.

[OphyTe]

Have you tried to escape quotes ?

Like this :

file {
path => "C:\Users\rtert\Documents\ElasticSearch/sortieSVI.txt"
codec => line { format => '{"script": {"source": "ctx._source[\'Categorie SVI\'] = \'%{Categorie SVI}\'","lang": "painless"},"query": {"term": {"ID Appel SVI.keyword": "%{ID Appel SVI}"}}}'}
}

[Pierre2]

Hello,
Thank you for your answer but if I try your proposal I got this error :

I think it is because of the "&gt". I tried to remplace "&gt" by ">" and the error disapeared but the result was not the good one. In the output file it was written " \ ' " instead of " ' ".

[OphyTe]

You can try to format your entries with the json_encode filter :

filter {
  json_encode {
    add_field => { "categorie_svi_field" => "ctx._source['Categorie SVI'] = '%{Categorie SVI}'" }
  }
}

file {
  path => "C:\Users\rtert\Documents\ElasticSearch/sortieSVI.txt"
  codec => line {
    format => '{
      "script": {
        "source": "%{categorie_svi_field}",
        "lang": "painless"
      },
      "query": {
         "term": { "ID Appel SVI.keyword" : "%{ID Appel SVI}" }
      }
    }'
  }
}

[Pierre2]

Hi,

I don't have the json_encode plugin installed so I tried with a basic
mutate
{
add_field....
}

and it works !

Thank you.

[OphyTe]

Happy to have been able to help, I'm a novice too