# Using wanted\_fields with in content code with single quotes

**URL:** <https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503>\
**Category:** Logstash\
**Created:** [February 25, 2017, 9:13pm UTC](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503 "2017-02-25T21:13:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![abd.wsu](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\
**Post date:** [February 25, 2017, 9:13pm UTC](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503/1 "2017-02-25T21:13:22Z")

</div>

I am trying to use a big logstash config file to parse my (atleast 100) csv file depending on the index created by filebeat.  
So, I am using the following code within my logstash conf file for these particular csv files.

logstash::configfile { 'stats\_filter':  
content =\> '  
filter {  
if [type] == "stats" {  
csv{  
separator =\> ","  
columns =\> ["Record Type","Record Code","Broker Name","Broker UUID","JVM Name","JVM UUID","Flow Name","Flow UUID","Application Name","Application UUID","Library Name","Library UUID","Record Start Date","Record Start Time","Record GMT Start Timestamp","Record End Date","Record End Time","Record GMT End Timestamp","Total Elapsed Time","Average Elapsed Time","Maximum Elapsed Time","Minimum Elapsed Time","Total CPU Time","Average CPU Time","Maximum CPU Time","Minimum CPU Time","CPU Time Waiting for Input Messages","Elapsed Time Waiting for Input Messages","Total Number of Input Messages","Total Size of Input Messages","Average Size of Input Messages","Maximum Size of Input Messages","Minimum Size of Input Messages","Number of Threads in Pool","Time Maximum Number of Threads reached","Total Number of Errors","Total Number of Messages with Errors","Total Number of Errors Processing Messages","Total Number of Time Outs Waiting for Replies to Aggregate Messages","Total Number of Commits","Total Number of Backouts","Accounting Origin"]  
}  
ruby {  
code =\> "  
wanted\_fields = ['Broker Name','JVM Name','Flow Name','Total CPU Time','Total Number of Input Messages','Record End Date','Record End Time']  
event.to\_hash.keys.each { |k|  
event.remove(k) unless wanted\_fields.include? k  
}"  
}  
mutate {  
rename =\> { "Broker Name" =\> broker\_name }  
rename =\> { "JVM Name" =\> jvm\_name }  
rename =\> { "Flow Name" =\> flowname }  
rename =\> { "Total CPU Time" =\> cputime }  
rename =\> { "Total Number of Input Messages" =\> input\_messages }  
add\_field =\> {  
"timestamp" =\> "%{Record End Date} %{Record End Time}"}  
remove\_field =\> ["Record End Date"]  
remove\_field =\> ["Record End Time"]  
}  
date{  
match =\> ["timestamp","yyyy-MM-dd HH:mm:ss.SSSSSS"]  
timezone =\> "Etc/UTC"  
remove\_field =\> ["timestamp"]  
}  
}  
}  
'  
}

I am writing the output to elasticsearch server. But when using the above code, since the filter content is within single quotes, i am erroring out at the wanted\_fields line since i am using a single quote there too. Is there anyway to make this work? I tried escaping the single quotes, use other options( like double quotes etc) but that gave me clear errors that I have to use single quotes for wanted\_fields. Is there another option? The filter has to be within content since as i said before this is part of a really large logstash conf file and this has to be done this way for consistency.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 26, 2017, 8:35am UTC](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503/2 "2017-02-26T08:35:17Z")

</div>

Why not use a `remove_field` instead?

---

<div class="post-metadata">

**Author:** ![abd.wsu](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\
**Post date:** [February 27, 2017, 5:20pm UTC](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503/3 "2017-02-27T17:20:38Z")

</div>

Thanks, Mark. Yup. This worked. This is also a more straightforward solution that my ruby code in my opinion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2017, 5:21pm UTC](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503/4 "2017-03-27T17:21:12Z")

</div>

Closed on March 27, 2017, 5:21pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.