Logstash Grok pattern with double quotes

regex elasticsearch logstash logstash-grok

If you escape " with backslash then it works fine.

%{NUMBER:ts} [......] (-|"%{USERNAME:token1}") (-|%{DATA:token2}) (-|"%{WORD:token3}") (-|"%{DATA:token4}")

Your new string will look like

%{NUMBER:ts} [......] (-|\"%{USERNAME:token1}\") (-|%{DATA:token2}) (-|\"%{WORD:token3}") (-|\"%{DATA:token4}\")

regex elasticsearch logstash logstash-grok

Changing the outer double quotes to single quotes instead did the trick for me:

grok {  match => { "message" => 'SOME "TEXT QUOTED"' }}

Hope it helps.

regex elasticsearch logstash logstash-grok

Try gsub after you have extracted the fields with quotes

filter {  mutate {    gsub => [      "fieldname", "\"", ""    ]  }}

CodeHunter