So you can see that even log.file.path which is included in yaml single quotes both in fields and in expected is some how getting an extra \ added (I accept that the display output is also doubling up on \ ).
Look at log.dir there is a \ at the end. If you think about the grok pattern it is clear that this backslash is being added at the input, because the grok pattern removes one backslash.
Running with 7.12 this grok pattern works with windows filebeats as the source.
Description
Backslashes are not parsed properly. I believe that LFV is adding an extra quote level and causing any backslash to be doubled up
Motivation
Testing grok patterns for windows paths on logstash 7.12
Exemplification
Using version 1.6.3
logstash config
I have this deployed and it is correctly parsing linux and windows paths
test case
results
conclusion
So you can see that even
log.file.path
which is included in yaml single quotes both in fields and in expected is some how getting an extra\
added (I accept that the display output is also doubling up on\
).Look at
log.dir
there is a\
at the end. If you think about the grok pattern it is clear that this backslash is being added at the input, because the grok pattern removes one backslash.Running with 7.12 this grok pattern works with windows filebeats as the source.