Using regex in dissect tokenizer

Elastic Stack Beats
1

Hi,

I'm using tokenizer to specify each field in log file, comma as the seperator. However, for one field, it sometimes contains quotes.

For instance, the line is like: other filed,hello,other field. Filebeat will deal with this line correctly. But the line maybe like: other field,"hello, everyone", other field. In this condition it will be seperated wrongly.

Can I use regex in tokenizer so that filebeat will distinguish quotes or is there any other configuration can solve this issue

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.