Tag: gsub

How to remove quotes in nested JSON?

How to remove quotes in nested JSON?

To remove quotes in nested JSON in logstash, add the following either one of mutate !

Option 1

mutate {
gsub => ["message", "(?<![:\[{,\]}])\"(?![:\]{}\]),"'"]
}

Option 2:

mutate {
gsub => ["message", "(?<![:|\[|{|,|\]|}])\"(?![:|\]|{|]),"'"]
}
Advertisements