[Logstash] Peut-on supprimer un backslash?

Elastic In Your Native Tongue Discussions en français
1

Bonjour,

J'arrive bien à supprimer plusieurs caractères spéciaux :

filter {
  mutate {
    gsub => ["message", "\[", ""]
    gsub => ["message", "\]", ""]
    gsub => ["message", "\(", ""]
    gsub => ["message", "\)", ""]
    gsub => ["message", "\<", ""]
    gsub => ["message", "\>", ""]
    gsub => [ "message", "\,", ""]
  }

Par contre dès que je veux aussi supprimer un backslash :

filter {
  mutate {
    gsub => ["message", "\[", ""]
    gsub => ["message", "\]", ""]
    gsub => ["message", "\(", ""]
    gsub => ["message", "\)", ""]
    gsub => ["message", "\<", ""]
    gsub => ["message", "\>", ""]
    gsub => [ "message", "\,", ""]
    gsub => [ "message", "\\", ""]
  }

Logstahs ne démarre pas :

Sep 27 13:51:57 NODE1 logstash[19606]: [2019-09-27T13:51:56,997][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :ex
ception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 40, column 33 (byte 859) after filter {\n  mutate {\n    gsub => [\"message\", \"\\[\", \"\"]\n    gsub => [\"messag
e\", \"\\]\", \"\"]\n    gsub => [\"message\", \"\\(\", \"\"] \n    gsub => [\"message\", \"\\)\", \"\"]\n    gsub => [\"message\", \"\\<\", \"\"]\n    gsub => [\"message\", \"\\>\", \"\"]\n    gsub => [
 \"message\", \"\\,\", \"\"]\n    gsub => [ \"message\", \"\\\\\", \"", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash
-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share
/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `i
nitialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/
logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}

Elasticsearch : 7.3.1
Logstahs : 7.3.1

Merci pour vos retour :slight_smile:

2

Personne pour lever le doute ? :wink:

3
4

Mmmh...strange...

It works with :

  mutate {
    gsub => ["message", "[\\]", "."]
  }

Backslash are deleted but not replaced by dot even if it should be done.

Problem solved thank you :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.