How to unset quote_char?

[sanori]

I want not to designate quote_char. How can I do it?

I want to read tsv (tab separated values) format data using csv filter. There is some fields including quote and double quote characters. Therefore, I want to set no quote_char, but I cannot find how.

There is similar Q&A in stackoverflow: http://stackoverflow.com/questions/23377475/how-can-i-read-csv-with-no-quote-char-in-ruby

But, since quote_char does not accept encoded character such as "\x00", I must input control character in the logstash configuration file. Is it intended to use logstash?

Related: There is similar issue in separator field http://stackoverflow.com/questions/30915011/logstash-tab-separator-not-escaping

[tomrade]

I have also had this issue, for most normal data sets I can set a rare character that wont come up, but when working web logs in particular, many attacks(SQL injection/Directory traversal) use a lot different characters. I tried non common/standard characters like '¬' make logstash error on startup (illegal quoting character).

The two options i have at the moment are use GROK with a simple NOT filter eg NOTSPACE use GSUB to remove my quoting character and then maybe try and put it back in. (which itself generates many issues)

[jakauppila]

+1

[IgorMedvedkov]

quote_char=>"\x00" worked well for me

[Skeeve]

1. @IgorMedvedkov it doesn't seem to work with \x00. I do not know what exactly ruby is doing here, but if you try to use another \x## sequence (\x09) it gives "quote_char has to be a single character String"
2. Using my separator as the quote_char worked for me ;) I'm using tab as the column separator. Setting it also as the quote char yielded the wanted result for the one example I tried. But I will not rely on this.