Unescape JSON Strings in Telemetry Pipelines

Remove escape characters from JSON strings before parsing. Works with single and multiply-escaped data from nested logging systems.

  2 minute read  

Minimum Agent Version: v1.31.0

Overview

EDXUnescapeJSON removes escape characters from JSON strings embedded in your telemetry data. Use it when log messages contain stringified JSON with backslash-escaped quotes that prevent parsing.

This function complements standard OTTL’s ParseJSON—use EDXUnescapeJSON first to remove escapes, then ParseJSON to convert the string into a structured object.

When to Use This Function

ScenarioExample InputSolution
JSON embedded in log body{"error":"{\"code\":500}"}EDXUnescapeJSON to unescape, then ParseJSON
Double-serialized data{\\\"user\\\":\\\"admin\\\"}EDXUnescapeJSON removes one escape layer
Direct JSON parsing{"code":200}Use ParseJSON directly—no escapes to remove

Syntax

EDXUnescapeJSON(input)

Parameters:

  • input: The escaped JSON string to unescape.

Returns: A string with one layer of escape characters removed. The result can be parsed with ParseJSON.

Examples

Example 1: Unescape and Parse Embedded JSON

A log message contains a JSON payload as an escaped string:

Input

{
  "_type": "log",
  "body": {
    "status": "error",
    "payload": "{\"code\":500,\"message\":\"Internal error\"}"
  }
}

Statement

set(attributes["parsed_payload"], ParseJSON(EDXUnescapeJSON(body["payload"])))

Output

{
  "_type": "log",
  "body": {
    "status": "error",
    "payload": "{\"code\":500,\"message\":\"Internal error\"}"
  },
  "attributes": {
    "parsed_payload": {
      "code": 500,
      "message": "Internal error"
    }
  }
}

Example 2: Handle Double-Escaped JSON

Some logging systems double-serialize data, adding extra escape layers:

Input

{
  "_type": "log",
  "body": {
    "details": "{\\\"error_code\\\":\\\"INV_PAY\\\",\\\"transaction_id\\\":\\\"TX12345\\\"}"
  }
}

Statement

set(attributes["unescaped"], EDXUnescapeJSON(body["details"]))
set(attributes["parsed"], ParseJSON(attributes["unescaped"]))

Output

{
  "_type": "log",
  "body": {
    "details": "{\\\"error_code\\\":\\\"INV_PAY\\\",\\\"transaction_id\\\":\\\"TX12345\\\"}"
  },
  "attributes": {
    "unescaped": "{\"error_code\":\"INV_PAY\",\"transaction_id\":\"TX12345\"}",
    "parsed": {
      "error_code": "INV_PAY",
      "transaction_id": "TX12345"
    }
  }
}

Example 3: Extract Nested Metadata

When JSON contains nested escaped JSON (common in distributed tracing):

Input

{
  "_type": "log",
  "body": {
    "level": "info",
    "metadata": "{\\\"user_id\\\":\\\"12345\\\",\\\"session\\\":\\\"abc-xyz\\\"}"
  }
}

Statement

set(attributes["user_info"], ParseJSON(EDXUnescapeJSON(body["metadata"])))
set(attributes["user_id"], attributes["user_info"]["user_id"])

Output

{
  "attributes": {
    "user_info": {
      "user_id": "12345",
      "session": "abc-xyz"
    },
    "user_id": "12345"
  }
}

Comparison with ParseJSON

FunctionPurposeInputOutput
ParseJSONConvert JSON string to object{"code":200}{code: 200} (object)
EDXUnescapeJSONRemove escape characters{\"code\":200}{"code":200} (string)

Common pattern: Chain both functions when data is escaped:

set(attributes["result"], ParseJSON(EDXUnescapeJSON(body["escaped_field"])))

See Also