logstash-filter-mutate
logstash-filter-mutate copied to clipboard
gsub won't replace to quote
For some reason the log source (which I don't control over) is sending lines with escaped signs:
$ cat notOK_sample.log
field1 field2 field3 \"field 4\" field5
I'm using the cvs filter as the main matching filter, it works well for the standardized/expected lines:
$ cat OK_sample.log
field1 field2 field3 "field 4" field5
In order to normalize the log lines, I thought about applying gsub to look for \"
and replace to "
, however it doesn't work (attempt 1,2). It does work if I choose other char, space, or nothing though (attempts 3,4).
- Attempt # 1
input line: \"field4\"
gsub filter: [ "message", "\\\"", "\"" ]
Rubydebug:
got: \\\"field4\\\"
expected: \"field4\"
- Attempt # 2
input line: \"field4\"
gsub filter: [ "message", "\\\"", "\\"" ]
Rubydebug:
got: \\\"field4\\\"
expected: \"field4\"
- Attempt # 3
input line: \"field4\"
gsub filter: [ "message", "\\\"", "" ]
Rubydebug:
got: field4
expected: field4
- Attemp # 4
input line: \"field4\"
gsub filter: [ "message", "\\\"", "x" ]
Rubydebug:
got: xfield4x
expected: xfield4x
Info:
$ ~/logstash-1.5.3/bin/logstash -V
logstash 1.5.3
$ sw_vers
ProductName: Mac OS X
ProductVersion: 10.10.4
BuildVersion: 14E46
$ ruby -v
ruby 2.0.0p481 (2014-05-08 revision 45883) [universal.x86_64-darwin14]