Removing substring from key and result

    { 

    "x'property'" : "x'true'",
    "x'type'" : "x'user'"

    } 

I need to parse it and want to remove the x' and single quotes from both key and value pair

like:

 { 

        "property" : "true",
        "type" : "user"

        } 

I have tried gsub and mutate, but unable to find solution

I have n number of fields like this.

I have tried with below and was able to replace and parse properly. Please check the below config.

input {
    stdin {}
}

filter {
    mutate { 
    	gsub => ["message", "x'", ""] 
    	gsub => ["message", "'", ""]
    }
    json { 
        source => "message"
    }
}

output {
    stdout {}
}

Input I used :

{"x'property'" : "x'true'","x'type'" : "x'user'"}

Output I got with the above config :

{
       "message" => "{\"property\" : \"true\",\"type\" : \"user\"}\r",
    "@timestamp" => 2019-07-23T06:36:33.736Z,
          "type" => "user",
      "@version" => "1",
      "property" => "true"
}

Hope this helps.

Instead of using gsub twice, I think we can use regex as well. But I'm not familiar with regex

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.