COMBINEDAPACHELOG with QS/QUOTEDSTRING does not remove quotes from referrer and user agent

Description

According to https://github.com/logstash/logstash/blob/v1.1.13/patterns/grok-patterns the COMBINEDAPACHELOG pattern reads:

%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}

That looks right because the referrer and agent have quotes around the string. But for some reason the quotes are not removed and are left in the resulting field.

Example input (tested in http://grokdebug.herokuapp.com/):
1.2.3.4 - - [11/Jun/2013:16:43:53 +0200] "GET /foo HTTP/1.0" 401 481 "-" "w3m/0.5.2+cvs-1.1027"

When I change the grok pattern to:
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) "%{DATA:referrer}" "%{DATA:agent}"
then I get the proper values without stray quotes.

I suspect that there is a problem with QUOTEDSTRING.

Activity

Show:
Philippe Weber
February 5, 2014, 10:04 AM

Keeping the quotes is the intended behavior of the QUOTEDSTRING grok pattern.

There is an old open request about having the possiblity to unquote such string in a filter, currently registered as

Assignee

Philippe Weber

Reporter

Christoph Haas

Labels

Affects versions

Configure