Escaped characters in exec.command get escaped too many times


I'm using backslashes in my exec.command to escape closing double quotes. This should let me use double quotes in my command itself. I only want to escape Logstash's parsing of my configuration file. I do NOT want to escape the characters passed in to the executed command itself (if I did, I would escape twice.


Sample Output

This is defying the expected behavior. It is escaping my backslash and then escaping my quote and thinking both are part of the command itself. I only want to escape Logstash's own internal parsing of my configuration file.

When I use 'SELECT 1' enclosed by single quotes, all works well, so I know it's not my setup of mysql that is failing.


January 10, 2014, 8:27 PM

The problem starts early on. If I use the -vv flag, the "escaped too many times" issues starts with the read parser.

Jordan Sissel
April 10, 2014, 10:36 PM

the problem is that \" in logstash config literally means two characters - backslash and a doublequote. It doesn't currently mean "A single character, doubleqoute" as you are expecting.

We should fix this, but historical behavior relies on not behaving the way you expect. I want to fix it, but don't want to burden existing users terribly.

In the meantime, use single quotes as you have discovered.

Philippe Weber
January 24, 2015, 11:47 AM

Root cause tracked in

As mentionned you can workaroud with single quote or by defining your scrip t in shell file


Logstash Developers




Affects versions