For example, my log is like:
2018-06-12T10:58:19.617Z, , "test,test", BJSGEXMBX12, , , SMTP, HARECEIVE, 41661182775666
How to split it by "," but ignore the "," in "test,test"? Thanks!
For example, my log is like:
2018-06-12T10:58:19.617Z, , "test,test", BJSGEXMBX12, , , SMTP, HARECEIVE, 41661182775666
How to split it by "," but ignore the "," in "test,test"? Thanks!
A csv filter would parse that, except that you have a space at the beginning of the field. If a field is quoted then the entire field has to be quoted. It has to be comma, double quote, field value, double quote, comma, with no spaces between the commas and the double quotes. Depending on what your data looks like you might be able to mutate+gsub the space away before using csv {}.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.