kv filter: support escaped quotes

Description

According to @whack

With the following config:

The following message:

Should create the following output:

But instead creates the following output:

Activity

Show:
Jordan Sissel
July 28, 2014, 9:03 PM

Was part of the conversation on IRC about this - This is totally a bug.

Jordan Sissel
July 28, 2014, 9:12 PM

The code itself looks for quoted strings by doing "

+" which captures anything up to the first double quote. It should be more like the QUOTEDSTRING pattern grok ships with.

Aaron Mildenstein
January 23, 2015, 7:46 PM
Philippe Weber
January 25, 2015, 8:54 AM

Assignee

Aaron Mildenstein

Reporter

Joseph Holsten

Labels

None

Affects versions

Configure