Remove double quotes from grok output

Elastic Stack Logstash
1

Hello,

Anyone know how to remove the double quotes out of the grok output ?

After grok filter, the ouput is "ip": "7.7.7.7", i would like to remove quotes and have an output like "ip": 7.7.7.7

I'm trying with gsub mutate options but escaping quotes seemes impossible.

filter {    
    mutate {
        gsub => ["ip", "\"", ""]
    }
}

Any solution please,
2

The quotes indicate it is a string datatype. There is no way to remove them.

3

Hello Badger,

Thnx for your response but is it possible to create ip datatype in logstash ?
I have to post some fields(like ipadress) to another server using soap webservice output in logstash, how can i do it ,i need to send ip address without quotes.

Thnx in advance

4

logstash does not have an ip datatype. What does your output configuration look like?

5

Hi again,

I receive syslogs data from rsyslog server and after preprossing using grok, i obtain fields like host,port, ipadress,timestamp which are strings after grok filter,..

I m using logstash http output to post some fields to another remote server,
i have to post ip adress & port ,the other server can receive filed without quotes because they are defined as integer at his side,so i could convert port to integer using mutate filter and the quotes were removed but i could not convert ipadress field to escaping these quotes.

below the request :

http
{
http_method => "post"
url => "http://X.X.X.X/abc/abc"

      content_type => "text/xml;charset=UTF-8"

     format => "message"
    message => '<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope

xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ws="http://X.X..X.X">
<soapenv:Header xmlns:svsec="http://X.X.X.X">
svsec:usernameX</svsec:username>
svsec:passwordY</svsec:password> </soapenv:Header>

soapenv:Body
ws:CreateNatMappingRequest

     <Debug>false</Debug>
     <NatRecord>
       
        <PrivateIpEndpoint>
           
           <IpAddress>%{ipadress}</IpAddress>
           
          <SessionQualifier>
                        <SiteNumber>4</SiteNumber>
                    </SessionQualifier>
        </PrivateIpEndpoint>
        
        <PublicIpEndpoint>
           
           <IpAddress>%{ipadresse2}</IpAddress>
           
           <SessionQualifier>
                        <LowPort>%{port}</LowPort>
                        <HighPort>%{port}</HighPort>
                    </SessionQualifier>
        </PublicIpEndpoint>
     </NatRecord>
  </ws:CreateNatMappingRequest>

</soapenv:Body> </soapenv:Envelope>'
}
stdout { codec => rubydebug }
}

6

If you do a sprintf substitution of a field that is a string then it does not include quotes.

7

You mean ${ipadresse2} instead of %{ipadresse2} ?

I yes i tried it but i have error Cannot evaluate ${ipadresse2}

8

No, I am saying that in something like

there will be no double quotes.

9

Hello,

Thx ,indeed there will be no double quotes.

Bsr,

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.