Have found myself in the position where I have malformed json, that won't be changed for a while.
Basically I have "realip": ""111.111.111.111" where I have an incidental extra double quote at the front.
This is json that is being send to logstash using filebeat, but for the life of me I can't get it to replace the double quotes with a single.
I have tried quiet a few things, but can't get it to play nice, which just removes one of the double quotes.
ATM I have
gsub => ["message","realip": "", "realip":"]