Doesn't respect quoted characters about logstash-filter-http

[MikeKemmerer]

This is expected behavior. The slash you’re using is escaping the doublequote inside of the doubleqoute encapsulated string. Try using 3 \ characters (one more to escape the slash and another to escape the quote).

[andsel]

@MikeKemmerer I would agree with you if the generator used the the double quotes:

message => "{\"Field1\": \"22222wwwww\"www\"wwwwww\"}"

but however to have to be right it should have quoted also the quote character like in:

message => "{\"Field1\": \"22222wwwww\\\"www\\\"wwwwww\"}"

but is uses the single quote:

message => '{"Field1": "22222wwwww\"www\"wwwwww"}'

Replacing the HTTP filter with HTTP output

output {
  http {
    ecs_compatibility => "disabled"
    http_method => "post"
    url => "http://localhost:8080"
  }
}

Behaves like expected on WireMock

Connection: [keep-alive]
Content-Type: [application/json]
Content-Length: [206]
Host: [localhost:8080]
User-Agent: [Manticore 0.9.1]
Accept-Encoding: [gzip,deflate]
{"Field1":"22222wwwww\"www\"wwwwww","@version":"1","event":{"original":"{\"Field1\": \"22222wwwww\\\"www\\\"wwwwww\"}","sequence":0},"host":{"name":"kalimera"},"@timestamp":"2023-02-28T15:25:13.743720606Z"}

[andsel]

@MikeKemmerer you are right the json

{"Field1": "22222wwwww\"www\"wwwwww"}

is a valid json, on which the Field1 contains the string with a couple of double quotes, and those double quotes needs to be quoted to be represented in json: 22222wwwww"www"wwwwww