syntax for a grok mutate gsub to replace double qu

问题:

Need a help

What is the syntax for using "grok mutate gsub" to replace double quotes with single quotes when using logstash.

Thanks,

回答1:

Do you want this? The mutate filter will change all the double quote to single quote.

filter {    
    mutate {
        gsub => ["message","\"","'"]
    }
}

回答2:

It is even possible to mix quotes in the gsub array. There's no need to escape it then. Like this:

filter {    
    mutate {
        gsub => ['message','"',"'"]
    }
}

回答3:

This seems to work:

   mutate {
        gsub => ['message','\"','`']
    }

For some reason escape for single quote \' (to replace double quotes) doesn't work, so used ` as a compromise