Illegal quoting in line (When i use " in csv file)

Elastic Stack Logstash
1

I use Logstash 5.4.1

This is my log

1498530290428|172.16.110.65|119.205.238.31|55081|80||||10|1|0|1|0|0|0|HTTP/1.1|www.dreamsearch.or.kr|/servlet/nateWebServlet?s=8375|Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36|http://news.nate.com/etc/adRightSpace?mid=n0500|0|0|KR|||!|#||SCOUTER=x7hs42eqvulj23; Start_Time=2016081810; kakao_uid=NONE; reffer_domain="NONE(20170627102828)|NONE(20170627102827)|NONE(20170627102823)|NONE(20170627102823)|NONE(20170627102821)"; ic_hu=16#news.topickorea.co.kr; ic_um=news.topickorea.co.kr; RTB_ABC=A; RTB_EC=E; IP_info=211.52.1.3.49807566; au_id=639a14a16985f8b5-78890f92158994388bc778c; shop_log_hold_sync=1; ic_ki=7IaM66eM7IKsIO2BtOudvOyasOuTnA||!|#||

This is an error message:
:exception=>#< CSV::MalformedCSVError: Illegal quoting in line 1. >

Details are below
15:17:53.190 [[main]>worker3] WARN logstash.filters.csv - Error parsing csv {:field=>"message", :source=>"1498530290428|172.16.110.65|119.205.238.31|55081|80||||10|1|0|1|0|0|0|HTTP/1.1|www.dreamsearch.or.kr|/servlet/nateWebServlet?s=8375|Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36|http://news.nate.com/etc/adRightSpace?mid=n0500|0|0|KR|||!|#||SCOUTER=x7hs42eqvulj23; Start_Time=2016081810; kakao_uid=NONE; reffer_domain=\\"NONE(20170627102828)|NONE(20170627102827)|NONE(20170627102823)|NONE(20170627102823)|NONE(20170627102821)\\"; ic_hu=16#news.topickorea.co.kr; ic_um=news.topickorea.co.kr; RTB_ABC=A; RTB_EC=E; IP_info=211.52.1.3.49807566; au_id=639a14a16985f8b5-78890f92158994388bc778c; shop_log_hold_sync=1; ic_ki=7IaM66eM7IKsIO2BtOudvOyasOuTnA||!|#||", :exception=>#< CSV::MalformedCSVError: Illegal quoting in line 1. >}

In my opinion, it is related to "Logstash ==> Filter ==> csv ==> quote_char"

I try to change quote_char, ex: quote_char => "`"

But error occur again.

Please help me :slight_smile:

2

If you look at what you just posted there is no error message. If you format that paragraph as preformatted text (see button in toolbar) the text between < and > won't be hidden.

Maybe the csv filter doesn't like the long column that begins with "SCOUTER=". If that's the case, perhaps you should try using a grok filter instead? Or a mutate filter's split option?

3

Oh my mistake. i edit my posting. In my think, when i use " in csv file, error occur.

4

I find !
Use this in Input field
delimiter => " "
Default is \n
Change it other value.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.