Regex_replace certain chacacter within quotes

[Phoebus]

Hi all, I’m trying to remove equals signs from within quotes inside message. Example qives you an idea what’s the problem:

field1=value field2="value=with=equals" field3="something else"

key=value extractor does a havoc here because it’s disturbed by the equals signs within the second value.
I (successfully) tested pipeline rule to replace = with %3D:

set_field("message", regex_replace(pattern:"[_]",value:$message.message,replacement:""));

but that apparently matches all equal signs. I tried doing match groups like "(.+?[^_])… but didn’t get far. Can someone help me write a regex that would replace equal signs, but only within quotes?

Thanks

[faen]

I have gotten through this issue by using the key_value function with trim_value_chars and trim_key_chars options. Here’s an example:

rule "Extract"
when
    has_field("source")
then
    set_fields(
        fields:key_value(
            value:to_string($message.message),
            trim_value_chars:"\",\'",
            trim_key_chars:"\",\'"
            )
        );
end

This parses all the field names and values, and removes the double quotes from each. Hope that helps.