Removing \ from raw input log data

[Merdesz]

I have a device sending in logs which have "" before every string caracter and I would like to remove them or rewrite them to a simple ". So this " --> " to this.

Logs:
srcintfrole="undefined" dstip=255.255.255.255 dstport=000 dstintf="interface" dstintfrole="interface" srccountry="Reserved" dstcountry="counrtyname" sessionid=2458616 proto=6 action="timeout" policyid=0 service="HTTPS"

I have tried with a logstash filter but it does not seem to work.

input {
  tcp {
    port => port_number
  }
}
filter{
  mutate {
    gsub => ["message", "\"", '"']
  }
}
output {
  elasticsearch {
    hosts => ["host_name"]
    index => "index_name"
    cacert => "cert_path"
    pipeline => "pipeline_name"
    user => "user_name"
    password => "password"
  }
}

The logs arrive into elasticsearch but without required modifications.

Any help or advice is greatly appreciated.

Márton

[Badger]

@Merdesz

mutate { gsub => ["message", "\"", '"'] }

That is a no-op. It replaces a double quote with a double quote. If you want to replace an escaped double quote with a double quote then try

 mutate { gsub => ["message", '\\"', '"'] }

Otherwise edit your post with appropriate markdown to make it clear what you want.

[Merdesz]

Thank you, this was all I needed.