Convert single quoted json log to double quoted before input

[dfgh012316]

Describe the enhancement:

I have some difficulty getting azure platform log using azure module .

The log format of the Azure function is inconsistent with the format of other platform logs, and it is an illegal json string.

{
"time": "2022-09-10T10:27:45Z",
"resourceId": "/SUBSCRIPTIONS/xxx/RESOURCEGROUPS/xxx/PROVIDERS/MICROSOFT.WEB/SITES/xxx",
"category": "FunctionAppLogs",
"operationName": "Microsoft.Web/sites/functions/log",
"level": "Error",
"location": "West Europe",
"properties": {'appName':'xxx','roleInstance':'xxx','message':'{'level':'info','time':'2022-09-10T10:27:45.818077054Z','message':'init config'}','category':'Host.Function.Console','hostVersion':'4.10.4.4','hostInstanceId':'xxx','level':'Error','levelId':4,'processId':60}
}

Reference:

https://learn.microsoft.com/en-us/answers/questions/1001797/invalid-json-logs-produced-for-function-apps?fbclid=IwAR0eQ5SFEfJHwCc2v_sUqxZm16YhymQyW9ef2039d3tA4VpaN7d4vYFrPa8

I don’t know if different encode inputs can be processed for the same input type in filebeat.

I'm sorry if there is already a way of doing this in filebeat

Describe a specific use case for the enhancement or feature:

I expect to be able to handle it like mutate in logstash .

mutate {
gsub => [
"message", "'", '"',
"message", ": None\b", ": null",
"message", ": True\b", ": true"
]
}
json { source => "message" remove_field => [ "message" ] }

Reference:

https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164

Or have any other suggestions please let me know

Thanks .

[botelastic]

This issue doesn't have a Team:<team> label.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!