How to remove additional comma in part of message

I have string between quotation marks that is separated by comma
example :"hello ,world"
logstash separate them in different column which is not the output that I want
I would like to remove the quotation and remove the comma

If the message will replace " to \ "
mutate { gsub => [ "message", '\"|,', "" ] }
or just to remove " and ,
mutate { gsub => [ "message", '"|,', "" ] }

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.