Parse nested key-values

Enable 'config.support_escapes: true' in your logstash.yml and then try this

    mutate { gsub => [ "message", "[\\\\]", "\\\\\\\\@@@@" ] }
    mutate { gsub => [ "message", "@@@@", "" ] }

You need the @@@@ junk because otherwise the final \ will escape the closing "

1 Like