4

Need a help

What is the syntax for using "grok mutate gsub" to replace double quotes with single quotes when using logstash.

Thanks,

user2025329
  • 177
  • 1
  • 2
  • 8
  • Please accept the answer if it helps. If not, please edit your question to include additional information (like what is in the answer comments). – tedder42 Feb 06 '15 at 22:58

3 Answers3

8

Do you want this? The mutate filter will change all the double quote to single quote.

filter {    
    mutate {
        gsub => ["message","\"","'"]
    }
}
Ban-Chuan Lim
  • 7,840
  • 4
  • 35
  • 52
  • Thanks... I did this thing, but now the problem is I am not able to apply grok pattern on the mutated log file. How you please help me on this. – user2025329 Mar 21 '14 at 12:54
  • Please provide more information, ex: configuration file, logs – Ban-Chuan Lim Mar 21 '14 at 14:11
  • This is what I am doing.. filter { mutate { gsub => ["message","\"","'"] } grok { type => "syslog" pattern => "^ver=5tid=local='(?(.*))'remote='(?(.*))'meth='(?(.*))'uri='(?(.*))'rtime='(?(.*))'$" } } – user2025329 Mar 26 '14 at 06:19
  • and my log format is like this ========= ver=5tid=local="newworld.com:80"remote="10.4100.0:39432"meth="GET"uri="/lbstatus.html"rtime="0.001"user=-""status="200"host=""href="'hua""=xfpt=""-'xfp=""http_al=-"''con="Close" ========= I am getting " replaced by ' in my logstash but grok patterning is not happening :( – user2025329 Mar 26 '14 at 06:20
  • Can i know which version of logstash you are using? – Ban-Chuan Lim Mar 26 '14 at 06:29
2

It is even possible to mix quotes in the gsub array. There's no need to escape it then. Like this:

filter {    
    mutate {
        gsub => ['message','"',"'"]
    }
}
Paul-Dieter Klumpp
  • 61
  • 3
  • this saved me, as I was attempting to replace single quotes with double, but ended up getting my single-quote replaced with: \" – SethYes Oct 18 '18 at 17:32
1

This seems to work:

   mutate {
        gsub => ['message','\"','`']
    }

For some reason escape for single quote \' (to replace double quotes) doesn't work, so used ` as a compromise

kevyau
  • 77
  • 1
  • 6