logstash-filter-mutate icon indicating copy to clipboard operation
logstash-filter-mutate copied to clipboard

gsub won't replace to quote

Open splashx opened this issue 9 years ago • 8 comments

For some reason the log source (which I don't control over) is sending lines with escaped signs:

$ cat notOK_sample.log
field1 field2 field3 \"field 4\" field5

I'm using the cvs filter as the main matching filter, it works well for the standardized/expected lines:

$ cat OK_sample.log
field1 field2 field3 "field 4" field5

In order to normalize the log lines, I thought about applying gsub to look for \" and replace to ", however it doesn't work (attempt 1,2). It does work if I choose other char, space, or nothing though (attempts 3,4).

  • Attempt # 1

input line: \"field4\" gsub filter: [ "message", "\\\"", "\"" ]

Rubydebug: got: \\\"field4\\\" expected: \"field4\"

  • Attempt # 2

input line: \"field4\" gsub filter: [ "message", "\\\"", "\\"" ]

Rubydebug: got: \\\"field4\\\" expected: \"field4\"

  • Attempt # 3

input line: \"field4\" gsub filter: [ "message", "\\\"", "" ]

Rubydebug: got: field4 expected: field4

  • Attemp # 4

input line: \"field4\" gsub filter: [ "message", "\\\"", "x" ]

Rubydebug: got: xfield4x expected: xfield4x

Info:

$ ~/logstash-1.5.3/bin/logstash -V
logstash 1.5.3
$ sw_vers
ProductName:    Mac OS X
ProductVersion: 10.10.4
BuildVersion:   14E46
$ ruby -v
ruby 2.0.0p481 (2014-05-08 revision 45883) [universal.x86_64-darwin14]

splashx avatar Aug 03 '15 14:08 splashx