Replacing special characters with gsub

Elastic Stack Logstash
1

I'm using gsub and regex to structure a field into json. Unfortunately, I'm having problems with double-quotes being escaped in the output. For example:

Field: event
Value: 'success': True

"event", "'", "\"",

Expected output "success": True

Actual output:
Kibana Table format
image

Kibana JSON format
image

Logstash pipeline config:
image

If I change the pipeline config and omit the escaping backslash character, Logstash throws an error: Expected one of [ \\t\\r\\n], \"#\", \"{\", \",\", \"]\" at line 215, column 29

Am I escaping special characters wrong with gsub?

2

Looking further into what im doing, it looks like gsub also doesn't support using capture groups and substitution? For example "event", "string (capture this)", "$1"

3

Capture groups are supported. Use "\1" to reference the first group.

If you need to use double quotes in a string then surround it with single quotes

mutate { gsub => [ "event", "'", '"' ] }
1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.