title: Remove characters from JSON
body: <p>I try to parse some json with logstash, currently the file which I like to enter has the following structure (simplified):</p>
  
  <pre><code>-4: {"audit":{"key1":"value1","key2":"value2"}}
  -4: {"audit":{"key1":"value1","key2":"value2"}}
  </code></pre>
  
  <p>Therefore I need to remove the -4: prefix in order to proper parse the file using json. Unfortunately I can not use the json codec for the input plugin, because it is not in proper json format. Therefore my requirements for the pipeline are:</p>
  
  <ol>
  <li>Remove the -4: prefix </li>
  <li>Code the event to json</li>
  <li>Do proper mutation</li>
  </ol>
  
  <p>I have tried with the following pipeline, which gives me a parse error:</p>
  
  <pre><code>input {
    tcp {
      port =&gt; 5001
      codec =&gt; multiline {
        pattern =&gt; "^-\d:."
        what =&gt; previous
      }
      #codec =&gt; json_lines
      type =&gt; "raw_input"
    }
  }
  
  filter {
    if [type] == "raw_input" {
      mutate {
        gsub =&gt; ["message", "^-\d:.", ""]
      }
    }
  
    json {
      source =&gt; "message"
    }
  
    mutate {
      convert =&gt; { "[audit][sequenceNumber]" =&gt; "integer" }
      add_field =&gt; { "test" =&gt; "%{[audit][sequenceNumber]}"}
    }
  }
  
  output {
    file {
      path =&gt; "/var/log/logstash/debug-output.log"
      codec =&gt; line { format =&gt; "%{message}" }
    }
  }
  </code></pre>
  
  <p>Is it possible to achieve this with logstash? Any suggestions how to do it?</p>