Logstash is escaping message!

Elastic Stack Logstash
1

Can I have access to the raw message before filters? My message is full with "\x22".
The easy way to deal with it is to use ruby and unpack the string, but...
Logstash escape everything an put another backslash in front of it, so now my message is full with "\\x22".
No matter what I try I cannot remove that one backslash, if I leave one single backslash using mutator or ruby regex. logstash will ever put a escape backslash there.
Do I have access to the raw message? so I can filter with ruby and unpack the message correctly before it pass down to the chain...
Im very stuck with this...

2

Yeah, the Logstash configuration language doesn't treat backslashes in a very good way. This works:

filter {
  ruby {
    code => "
      event['message'] = event['message'].gsub([92].pack('U') + 'x22',
                                               [34].pack('U'))
    "
  }
}

92 is the codepoint for backslash and 34 the codepoint for a double quote. It should be easy to generalize this code to support any \xNN sequences.