Json with double quote

Graylog Central (peer support)
,
1

Hi guys,
I have to manage some input message like this:

"{""Actor"":[{""ID"":""3bd441cb-efea-476f-8a2e-d528bc5373e8"",""Type"":0},{""ID"":""first.last@email.com"",""Type"":5}],
""ActorContextId"":""9c848b2a-49ba-4c39-9749-118d06717a84"",""ActorIpAddress"":""10.0.0.0"",""ApplicationId"":""0000000c-0000-0000-c000-00000000000"",""AzureActiveDirectoryEventType"":1""}"

It seems a Json but I need to remove first the double quote and then the quote before and after the
curly brackets.
Is there somebody that can address me to understand how I can do it?
Is there some function or comlpex extractor that I can use?

Thanks
Gianluca

2

in a pipeline you can try the regex_replace() function:

regex_replace("\\"\\"",$message.message,"\\"",TRUE);

I haven’t tested it, but I think that would replace all "" with "

Note in the pipeline you would have to double escape your quotes \\"

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.