Remove double quotes from grok output


Anyone know how to remove the double quotes out of the grok output ?

After grok filter, the ouput is "ip": "", i would like to remove quotes and have an output like "ip":

I'm trying with gsub mutate options but escaping quotes seemes impossible.

filter {    
    mutate {
        gsub => ["ip", "\"", ""]

Any solution please,

The quotes indicate it is a string datatype. There is no way to remove them.

Hello Badger,

Thnx for your response but is it possible to create ip datatype in logstash ?
I have to post some fields(like ipadress) to another server using soap webservice output in logstash, how can i do it ,i need to send ip address without quotes.

Thnx in advance

logstash does not have an ip datatype. What does your output configuration look like?

Hi again,

I receive syslogs data from rsyslog server and after preprossing using grok, i obtain fields like host,port, ipadress,timestamp which are strings after grok filter,..

I m using logstash http output to post some fields to another remote server,
i have to post ip adress & port ,the other server can receive filed without quotes because they are defined as integer at his side,so i could convert port to integer using mutate filter and the quotes were removed but i could not convert ipadress field to escaping these quotes.

below the request :

http_method => "post"
url => "http://X.X.X.X/abc/abc"

      content_type => "text/xml;charset=UTF-8"

     format => "message"
    message => '<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope 

<soapenv:Header xmlns:svsec="http://X.X.X.X">
svsec:passwordY</svsec:password> </soapenv:Header>



</soapenv:Body> </soapenv:Envelope>'
stdout { codec => rubydebug }

If you do a sprintf substitution of a field that is a string then it does not include quotes.

You mean ${ipadresse2} instead of %{ipadresse2} ?

I yes i tried it but i have error Cannot evaluate ${ipadresse2}

No, I am saying that in something like

there will be no double quotes.


Thx ,indeed there will be no double quotes.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.