# Json with double quote

**URL:** <https://community.graylog.org/t/json-with-double-quote/23986>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, key\_value\
**Created:** [May 24, 2022, 3:33pm UTC](https://community.graylog.org/t/json-with-double-quote/23986 "2022-05-24T15:33:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [May 24, 2022, 3:33pm UTC](https://community.graylog.org/t/json-with-double-quote/23986/1 "2022-05-24T15:33:56Z")

</div>

Hi guys,  
I have to manage some input message like this:

```auto
"{""Actor"":[{""ID"":""3bd441cb-efea-476f-8a2e-d528bc5373e8"",""Type"":0},{""ID"":""first.last@email.com"",""Type"":5}],
""ActorContextId"":""9c848b2a-49ba-4c39-9749-118d06717a84"",""ActorIpAddress"":""10.0.0.0"",""ApplicationId"":""0000000c-0000-0000-c000-00000000000"",""AzureActiveDirectoryEventType"":1""}"

```

It seems a Json but I need to remove first the double quote and then the quote before and after the  
curly brackets.  
Is there somebody that can address me to understand how I can do it?  
Is there some function or comlpex extractor that I can use?

Thanks  
Gianluca

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [May 24, 2022, 6:11pm UTC](https://community.graylog.org/t/json-with-double-quote/23986/2 "2022-05-24T18:11:05Z")

</div>

in a pipeline you can try the `regex_replace()` function:

`regex_replace("\\"\\"",$message.message,"\\"",TRUE);`

I haven’t tested it, but I think that would replace all `""` with `"`

Note in the pipeline you would have to double escape your quotes `\\"`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 7, 2022, 6:11pm UTC](https://community.graylog.org/t/json-with-double-quote/23986/3 "2022-06-07T18:11:26Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.