Syntax for grok mutate gsub to replace double quotes with single quotes

Question

Help is needed

What is the syntax for using "grok mutate gsub" to replace double quotes with single quotes when using logstash.

Thank,

Answer 1

Do you want this? The mutate filter will change the entire double quote to a single quote.

filter {    
    mutate {
        gsub => ["message","\"","'"]
    }
}

Answer 2

It works:

   mutate {
        gsub => ['message','\"','`']
    }

For some reason, escaping for a single quote (to replace double quotes) does not work, so it is used `as a compromise

Answer 3

gsub. . :

filter {    
    mutate {
        gsub => ['message','"',"'"]
    }
}