# Logstash convert single quoted json log to double quoted

**URL:** <https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164>\
**Category:** Logstash\
**Created:** [October 21, 2022, 5:41am UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164 "2022-10-21T05:41:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![babuzrb](https://avatars.discourse-cdn.com/v4/letter/b/bcef8e/32.png) [@babuzrb](https://discuss.elastic.co/u/babuzrb)\
**Post date:** [October 21, 2022, 5:41am UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164/1 "2022-10-21T05:41:18Z")

</div>

Hi I have log files with multiple json lines. Each json has single quotes and some of the values do not even has any quote. Due to this single quote and absence of quote issue, I cannot index them to elasticsearch. Through logstash I need to replace all single quotes to double quotes and also add double quotes to all constant type values (i.e: True, None to "True", "None" etc.).  
If you could help please? Example data:

```auto
{
   'key1': 'value1',
   'key2':{
      'k1': 'v1',
      'k2': 'v2'
   },
   'key3':[
      'test1',
      'test2'
   ],
   'key3': True,
   'key4': None
}
{
   'key11': 'value1',
   'key12':{
      'k11': 'v1',
      'k12': 'v2'
   },
   'key13':[
      'test1',
      'test2'
   ],
   'key13': True,
   'key14': None
}

```

FYI @Badger

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 21, 2022, 3:40pm UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164/2 "2022-10-21T15:40:53Z")

</div>

It might be fragile, but you could try

```
    mutate {
        gsub => [
            "message", "'", '"',
            "message", ": None\b", ": null",
            "message", ": True\b", ": true",
            "message", "\A", "[",
            "message", "\Z", "]",
            "message", "^}$", "},"
        ]
    }
    json { source => "message" remove_field => ["message"] target => "data" }

```

---

<div class="post-metadata">

**Author:** ![babuzrb](https://avatars.discourse-cdn.com/v4/letter/b/bcef8e/32.png) [@babuzrb](https://discuss.elastic.co/u/babuzrb)\
**Post date:** [October 21, 2022, 4:10pm UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164/3 "2022-10-21T16:10:35Z")

</div>

Hi @Badger, I will try. Need a suggestion. Though I have shared the formatted jsons in the question, actually my jsons are not formatted in the log file. There are many single line jsons in each log file. Example:

```auto
{ 'key1': 'value1', 'key2':{ 'k1': 'v1', 'k2': 'v2' }, 'key3':['test1', 'test2'], 'key3': True, 'key4': None }
{ 'key11': 'value1', 'key12':{ 'k11': 'v1', 'k12': 'v2' }, 'key13':['test1', 'test2'], 'key13': True, 'key14': None }

```

Which codec I shall use? `json_lines` or `multiline` or `json`?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 21, 2022, 4:50pm UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164/4 "2022-10-21T16:50:30Z")

</div>

I wouldn't use any codec for that, just use

```
    mutate {
        gsub => [
            "message", "'", '"',
            "message", ": None\b", ": null",
            "message", ": True\b", ": true"
        ]
    }
    json { source => "message" remove_field => ["message"] }

```

---

<div class="post-metadata">

**Author:** ![babuzrb](https://avatars.discourse-cdn.com/v4/letter/b/bcef8e/32.png) [@babuzrb](https://discuss.elastic.co/u/babuzrb)\
**Post date:** [October 22, 2022, 3:40am UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164/5 "2022-10-22T03:40:05Z")

</div>

Thanks @Badger . Your solution worked like a charm!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2022, 3:40am UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164/6 "2022-11-19T03:40:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.