shagun
(Shagun)
July 23, 2019, 4:24am
1
{
"x'property'" : "x'true'",
"x'type'" : "x'user'"
}
I need to parse it and want to remove the x' and single quotes from both key and value pair
like:
{
"property" : "true",
"type" : "user"
}
I have tried gsub and mutate, but unable to find solution
I have n number of fields like this.
I have tried with below and was able to replace and parse properly. Please check the below config.
input {
stdin {}
}
filter {
mutate {
gsub => ["message", "x'", ""]
gsub => ["message", "'", ""]
}
json {
source => "message"
}
}
output {
stdout {}
}
Input I used :
{"x'property'" : "x'true'","x'type'" : "x'user'"}
Output I got with the above config :
{
"message" => "{\"property\" : \"true\",\"type\" : \"user\"}\r",
"@timestamp" => 2019-07-23T06:36:33.736Z,
"type" => "user",
"@version" => "1",
"property" => "true"
}
Hope this helps.
Instead of using gsub twice, I think we can use regex as well. But I'm not familiar with regex
1 Like
system
(system)
Closed
August 20, 2019, 7:14am
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.