Logstash csv parser with single and double quotes

Elastic Stack Logstash
1

I'm having a hard time processing logs with the logstash csv filter, my logs are in a csv format with tab delimited, it has fields which may contain single quotes and also it contains json objects,

http://www.example.com/TIGER'S-EYE	\N	\N	\N	 15:5 12:5 1:35 14:44 74:100	\N	{ "Referer" : "https://www.google.com/", "User-Agent" : "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"}	\N	\N	\N	1000007272642	\N

I have tried adding the quote_char => "'" option and this fixed the logs which contain json but still having an issue with logs which contains a single quote I'm getting an error "logstash malformedcsverror: illegal quoting in line 1"

2

If your log lines do not follow CSV quoting conventions then you will not be able to parse them using a csv filter. You may have to use mutate+split and then mutate+rename to parse them.