Small help with gsub

Elastic Stack Logstash
1

I have this string: (dont ask :slight_smile: )

"{"InternalMessageQueueSize":5,"ExceptionsNumber":300}"

i like to change it with gsub to this:

{"InternalMessageQueueSize":5,"ExceptionsNumber":300}

can you help with the sytax?

2

Well, what you really want is this:

{"InternalMessageQueueSize":5,"ExceptionsNumber":300}

3

Basically the message is :
"{"InternalMessageQueueSize":5,"ExceptionsNumber":300}"

Logstash add escape character to the message:
""{\"InternalMessageQueueSize\":5,\"ExceptionsNumber\":300}""

i am using gsub like this to remove \:
gsub => ["message", "[\]", ""]
""{"InternalMessageQueueSize":5,"ExceptionsNumber":300}""

now i need to remove the start " and the last one to be like this
"{"InternalMessageQueueSize":5,"ExceptionsNumber":300}"

and after when i set a json filter its working perfect

4

I found how to do it:

Original message:

"{"InternalMessageQueueSize":5,"ExceptionsNumber":300,"test1":400,"EventDate":"2015-09-21T11:12:10.047Z"}"

mutate {
gsub => ["message", "[\]", ""]
gsub => ["message", """, ""]
gsub => ["message", "", """]
gsub => ["message", "[\]", ""]
}
json {
source => "message"
}

And i get:

{
"message" => "{"InternalMessageQueueSize":5,"ExceptionsNumber":300,"test1":400,"EventDate":"2015-09-21T11:12:10.047Z"}",
"@version" => "1",
"@timestamp" => "2015-09-21T11:15:53.448Z",
"type" => "app.metric",
"tags" => [
[0] "app.metric"
],
"InternalMessageQueueSize" => 5,
"ExceptionsNumber" => 300,
"test1" => 400,
"EventDate" => "2015-09-21T11:12:10.047Z"
}