Logstash escaping characters, want to disable

Elastic Stack Logstash
1

Hi! I'm having a problem with how Logstash with JDBC input escapes characters.
When I run the SQL query in SSMS I get the result fine: "\publicerat\IN0022.pdf"
The JDBC input looks like this:

input {
    jdbc {
        jdbc_connection_string => "jdbc:sqlserver://lifescience;"
        jdbc_user => "xxx"
        jdbc_password => "xxx"
        jdbc_driver_library => "./logstash-core/lib/jars/mssql-jdbc-9.2.1.jre8.jar"
        jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
        statement => "select id, path from table"
        tracking_column => "mrec_datetime"
        tracking_column_type => "timestamp"
        use_column_value => true
        last_run_metadata_path => "./logs/.logstash_jdbc_last_run"
        schedule => "*/30 * * * * *"
    }
}

But when I query Elasticsearch with

GET /myindex/_search
{
    "from" : 0, "size" : 1000,
    "query" : {
        "match_all": {}
    }
}

It has been indexed as "path": "\"\\publicerat\\IN0022.pdf\"",

How can I disable the escape that is happening here?

2

One thought I had was that there might be different types of the field, which is was ("path" was just a text without any analyzer or anything).
But I recreated the index and reindexed the documents with the same settings as the index created by FSCrawler has, but it's still encoded every " as \" and every \ as \\

        "path": {
          "type": "keyword",
          "fields": {
            "fulltext": {
              "type": "text"
            },
            "tree": {
              "type": "text",
              "analyzer": "fscrawler_path",
              "fielddata": true
            }
          }
        },


            "virtual": {
              "type": "keyword",
              "fields": {
                "fulltext": {
                  "type": "text"
                },
                "tree": {
                  "type": "text",
                  "analyzer": "fscrawler_path",
                  "fielddata": true
                }
              }
            }

*virtual is from FSCrawler and "path" is from Logstash/JDBC/SQL Server

3

Just to follow up: This issue we're facing is related to this issue in Logstash:

Downgraded to 8.3.3 and reindexing everything solved it. Issue still exists in version 8.5.2

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.