# Remove extra double quote for a json object

**URL:** <https://discuss.elastic.co/t/remove-extra-double-quote-for-a-json-object/187942>\
**Category:** Logstash\
**Created:** [June 27, 2019, 10:56pm UTC](https://discuss.elastic.co/t/remove-extra-double-quote-for-a-json-object/187942 "2019-06-27T22:56:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![singham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/singham/32/47780_2.png) [@singham](https://discuss.elastic.co/u/singham)\
**Post date:** [June 27, 2019, 10:56pm UTC](https://discuss.elastic.co/t/remove-extra-double-quote-for-a-json-object/187942/1 "2019-06-27T22:56:57Z")

</div>

**My JSON object coming from Kafka stream is as below**

"""{"attack\_type\_etd" : ""DDOS"","business\_system\_id" : ""34521"","card\_number" : ""6937-8119-1476-3355"","client\_id" : "22","edge\_id" : 4,"email" : ""user7@client.com"","geographical\_external\_ip" : ""883130348943"","hostname" : ""hostname8"","ip\_dst" : ""290144530263"","ip\_extra" : ""309587090137"","ip\_src" : ""434326440085"","isp\_name" : """","log\_type\_cd" : ""98"","log\_subject" : ""Denied"","log\_subject\_info" : ""Info"","original\_timestamp" : "1561654383","payload\_path" : """","port\_dst" : ""97482"","port\_src" : ""64487"","message" : ""hello world"","raw\_log" :"RECVTIME=1561654383.248093 SEQ=8 SRCIP=830.8.33.337 FACILITY=98 SEVERITY=5 MESSAGE=\<3\> fwns-holehole: NetScreen device\_id=fwns-holehole [Root]system-notification-00257(traffic): start\_time="2019-06-27 16:53:03" duration=9 policy\_id=9 service=dns proto=34 src zone=Trust dst zone=Trust action=Allow sent=8 rcvd=57 src=2.118.69.1 dst=270.20.118.86 src\_port=63299 dst\_port=40845 session\_id=35 message="hello world"","received\_timestamp" : "1561654383","regex\_id" : ""26"","rule\_identifier" : ""ID967"","severity" : """","status\_cd" : ""1"","username" : ""user81""}""",

**After using json filter the log is formated correctly but it is having multiple quotes as below for example**

"email" : """"user7@client.com"""",  
"username" : """"user8"""",

**I am not sure how to remove two double quotes from the value . Could you please suggest**

---

<div class="post-metadata">

**Author:** ![singham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/singham/32/47780_2.png) [@singham](https://discuss.elastic.co/u/singham)\
**Post date:** [June 27, 2019, 11:29pm UTC](https://discuss.elastic.co/t/remove-extra-double-quote-for-a-json-object/187942/2 "2019-06-27T23:29:11Z")

</div>

For someone who faced similar issue, below fixed the problem

filter {

```
mutate {
    gsub => ["message","\\"",""]
}
json{
		source => "message"
}

```

}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2019, 11:29pm UTC](https://discuss.elastic.co/t/remove-extra-double-quote-for-a-json-object/187942/3 "2019-07-25T23:29:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.