Weird mutate gsub behaviour double quotes


(Jason) #1

Have found myself in the position where I have malformed json, that won't be changed for a while.

Basically I have "realip": ""111.111.111.111" where I have an incidental extra double quote at the front.

This is json that is being send to logstash using filebeat, but for the life of me I can't get it to replace the double quotes with a single.

I have tried quiet a few things, but can't get it to play nice, which just removes one of the double quotes.

ATM I have
gsub => ["message","realip": "", "realip":"]


(system) #2