How to get rid of extra double quote

Elastic Stack Logstash
1

I have this logstash filter I'm struggling with. Right now it comes out like this in rubydebug:
{
"type" => "log",
"host" => "CY-C0D6E-006",
"Date" => "2016-10-12",
"Time" => "14:35:43.891",
"computername" => ""Z49OS2SWB114T"",
"serverIP" => "127.0.0.1",
"method" => "GET",
"uriStem" => "/iis/1/healthcheck/",
}

My problems is that these fields will not always have the ", so I can't fix it in the grok filter, I have to do it afterwards in each field. However, I'm struggling to come up with a gsub statement that can help me.

Does anyone have any pointers on what I can do to normalize these strings?

best regards,
Trond

2

Should work:

mutate {
  gsub => ["computername", '"', '']
}
1 Like
3

Thanks, I will try that