Pre-process message backslashes prior to JSON filter

Elastic Stack Logstash
1

I'm trying to replace the literal string "\x" with "\u00" just before parsing JSON to (somewhat naively) convert invalid hex escapes (coming from Nginx) into Unicode escapes. However no matter what I try I always get LogStash::Json::ParserError: Unexpected character ('\' (code 92)): was expecting double-quote to start field name.

My filter:

filter {
  mutate { gsub => [ "message", "\\x", "\\u00" ] }
  json { source => "message" }
}

I've tried every combination of single, double and quadruple backslash in the regex pattern and replace values but no luck. Where am I going wrong?

2

Does config.support_escapes work for you?

3

No change unfortunately. The only difference is I had to use quadruple backslash in my filter definition above, which makes sense.

4

I believe the intent of that option was the opposite, so that you could use single backslashes.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.