Logstash CSV parse Failure

Elastic Stack Logstash
1

Hi All,
I have a log file which I need to parse using logstash but somehow I am stuck parsing the same. The use case is

I have a log file which has entries separated with ||| and message also has " in it. So while parsing with CSV its giving parsing exception ,

Sample entries in log file as test.txt:

"1"|||"somthing here"|||"somthing with " in here"|||"just for fun"
"2"|||"somthing here"|||"somthing with " in here"|||"just for fun"
"3"|||"somthing here"|||"somthing with " in here"|||"just for fun"

And logstash conf as :

input {
  file {
    path => ["/home/ubuntu/test.txt"]
  }
}
filter {
		csv {
			separator => "|||"
		 }
}
output {
	stdout { codec => rubydebug }
}

The catch is I am fine doing gsub """ with "" , but I want to preserve the " which is in fields 3 as something with " in here"

Thanks!

2

Perhaps you can use a mutate filter and its split option to split on the |||, then use gsub to remove leading and trailing double quotes?

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.