Hi,
I have a filter with:
mutate {
gsub => [
"message", "\u003e", ">",
"message", "\u003c", "<",
"message", "[\n]", "",
"message", "\"", "'"
]
}
that I apply to :
{"log":"screen=None callback_url='/api' request_type='sms' handler="\u003cclass 'Entrypoint'\u003e" event='entry_point_handler'\n","stream":"stdout","time":"2018-03-09T07:39:59.580260866Z"}
the mutate does not get applied in fact in the logstash output I see that message is now:
{\"log\":\"screen=None callback_url='/api' request_type='sms' handler=\"\\u003cclass 'Entrypoint'\\u003e\" event='entry_point_handler'\\n",\"stream":\"stdout",\"time":\"2018-03-09T07:39:59.580260866Z\"}
even worse.
What I really want to do is get rid of the special character because it seems to be what is stopping the json plugin from working
thanks
Phill