Replacing Special Characters

( #1


I have a filter with:

mutate {
gsub => [
"message", "\u003e", ">",
"message", "\u003c", "<",
"message", "[\n]", "",
"message", "\"", "'"

that I apply to :
{"log":"screen=None callback_url='/api' request_type='sms' handler="\u003cclass 'Entrypoint'\u003e" event='entry_point_handler'\n","stream":"stdout","time":"2018-03-09T07:39:59.580260866Z"}

the mutate does not get applied in fact in the logstash output I see that message is now:
{\"log\":\"screen=None callback_url='/api' request_type='sms' handler=\"\\u003cclass 'Entrypoint'\\u003e\" event='entry_point_handler'\\n",\"stream":\"stdout",\"time":\"2018-03-09T07:39:59.580260866Z\"}

even worse.

What I really want to do is get rid of the special character because it seems to be what is stopping the json plugin from working



(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.