Remove extra double quote for a json object

Elastic Stack Logstash
1

My JSON object coming from Kafka stream is as below

"""{"attack_type_etd" : ""DDOS"","business_system_id" : ""34521"","card_number" : ""6937-8119-1476-3355"","client_id" : "22","edge_id" : 4,"email" : ""user7@client.com"","geographical_external_ip" : ""883130348943"","hostname" : ""hostname8"","ip_dst" : ""290144530263"","ip_extra" : ""309587090137"","ip_src" : ""434326440085"","isp_name" : """","log_type_cd" : ""98"","log_subject" : ""Denied"","log_subject_info" : ""Info"","original_timestamp" : "1561654383","payload_path" : """","port_dst" : ""97482"","port_src" : ""64487"","message" : ""hello world"","raw_log" :"RECVTIME=1561654383.248093 SEQ=8 SRCIP=830.8.33.337 FACILITY=98 SEVERITY=5 MESSAGE=<3> fwns-holehole: NetScreen device_id=fwns-holehole [Root]system-notification-00257(traffic): start_time="2019-06-27 16:53:03" duration=9 policy_id=9 service=dns proto=34 src zone=Trust dst zone=Trust action=Allow sent=8 rcvd=57 src=2.118.69.1 dst=270.20.118.86 src_port=63299 dst_port=40845 session_id=35 message="hello world"","received_timestamp" : "1561654383","regex_id" : ""26"","rule_identifier" : ""ID967"","severity" : """","status_cd" : ""1"","username" : ""user81""}""",

After using json filter the log is formated correctly but it is having multiple quotes as below for example

"email" : """"user7@client.com"""",
"username" : """"user8"""",

I am not sure how to remove two double quotes from the value . Could you please suggest

2

For someone who faced similar issue, below fixed the problem

filter {

mutate {
    gsub => ["message","\\"",""]
}
json{
		source => "message"
}

}

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.