Logstash_1.4.2 : add double quote with grok

Elastic Stack Logstash
1

Hi,

I'm actually trying to generate a csv file, for a GeoIP database.

My goal is to have this:

"startIpNum","endIpNum","locId"

And i actually have this, without the double quotes:

startIpNum,endIpNum,locId

How to add the double quotes ? I try to escape them, but i obtain this:

"\"""startIpNum"\""","\"""endIpNum"\""","\"""locId"\"""

I try with single quote, but i obtain this :

"""startIpNum""","""endIpNum""","""locId"""

For info, here is my grok filter, where i generate the field :

add_field => { "startIpNum" => "%{store_net}1" }

Thanks for your time !

2

Are you using the csv output? Please show a minimal configuration example that exhibits your problem. I don't understand what the grok filter has to do with creating a CSV file.

3

Yes, it's a csv output:

output {
  csv {
    fields => ["startIpNum", "endIpNum", "locId"]
    path = "/my/path/to/output.csv"
  }
}
1 Like