# Logstash double quote escape

**URL:** <https://discuss.elastic.co/t/logstash-double-quote-escape/98089>\
**Category:** Logstash\
**Created:** [August 23, 2017, 2:00pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089 "2017-08-23T14:00:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin\_Liang](https://avatars.discourse-cdn.com/v4/letter/k/3bc359/32.png) [@Kevin\_Liang](https://discuss.elastic.co/u/Kevin_Liang)\
**Post date:** [August 23, 2017, 2:00pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089/1 "2017-08-23T14:00:34Z")

</div>

I have a JSON message that is not escaping well due to a double quote after

```
"<?xml

```

as below:

```
[2017-08-21T23:59:59,133][WARN][logstash.codecs.jsonlines] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character ('<' (code 60)): was expecting comma to separate OBJECT entries
 at [Source: { "type":"syslog","host":"host1","role":"ingest_log","message":" [HFB] 2017-08-22 00:00:04,260 INFO [MuleScheduler1_Worker-10] outgoing.Manager (::): Converting Xml into object for xml: "<?xml version="1.0" ...""}; line: 1, column: 209]>, :data=>"{ \"type\":\"syslog\",\"host\":\"host1\",\"role\":\"ingest_log\",\"message\":\" [HFB] 2017-08-22 00:00:04,260 INFO [MuleScheduler1_Worker-10] outgoing.Manager (::): Converting Xml into object for xml: \"<?xml version=\"1.0\" ...\"\"}"}

```

I tried the follow filter below.

```
filter{
 if [role] == "ingest_log" {
   mutate {
      gsub => ["message",'"','\"']}
    grok {
      match => ["message", " INFO %{TIMESTAMP_ISO8601:timestamp_match} %{GREEDYDATA:message}"]
      match => ["message", ' INFO %{TIMESTAMP_ISO8601:timestamp_match} %{GREEDYDATA:message}']
      overwrite => ["message"] }
    date {
      match => ["timestamp_match", "yyyy-MM-dd HH:mm:ss,SSS"]
      target=> "@timestamp"
      remove_field => ["timestamp_match"]}}
}

```

The mutate doesn't look to do anything, am I doing this incorrectly?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2017, 9:04pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089/2 "2017-08-23T21:04:59Z")

</div>

The log you're trying to parse appears to be invalid JSON. That's hard to fix. Please see if you can fix the real problem.

The json\_lines codec is run before any filters. If you want to fix the broken JSON using a filter you need to do that before you use a json filter to parse the JSON blob.

---

<div class="post-metadata">

**Author:** ![Kevin\_Liang](https://avatars.discourse-cdn.com/v4/letter/k/3bc359/32.png) [@Kevin\_Liang](https://discuss.elastic.co/u/Kevin_Liang)\
**Post date:** [August 25, 2017, 1:16pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089/3 "2017-08-25T13:16:57Z")

</div>

Damn. Is there a best practice to do this? I am sending the logs via rsyslog.

here is my template:  
$template ls\_json,"{ "type":"syslog","host":"%HOSTNAME%","role":"%app-name%","message":" %msg:::json%"}"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2017, 1:25pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089/4 "2017-08-25T13:25:57Z")

</div>

If you can't get rsyslog to serialize to JSON properly I suggest you avoid JSON. Since presumably the message is the only "free form" token (i.e. a token that can contain e.g. spaces and quotes) , perhaps you can just do a simple key=value list that's easy to parse on the Logstash side?

---

<div class="post-metadata">

**Author:** ![Kevin\_Liang](https://avatars.discourse-cdn.com/v4/letter/k/3bc359/32.png) [@Kevin\_Liang](https://discuss.elastic.co/u/Kevin_Liang)\
**Post date:** [September 8, 2017, 8:07pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089/5 "2017-09-08T20:07:11Z")

</div>

Thanks, took your suggestion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2017, 8:07pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089/6 "2017-10-06T20:07:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.