broken.json

hello  {"foo":"bar"}

broken.out.json

{
        "message" => "hello \\xC2 {\\\"foo\\\":\\\"bar\\\"}",
       "@version" => "1",
     "@timestamp" => "2015-08-03T10:26:07.100Z",
           "host" => "igor-rg.local",
    "jsoninsides" => "{ \\\"foo\\\":\\\"bar\\\" }"
}

fixed.json

hello {"foo":"bar"}

fixed.out.json

{
        "message" => "hello {\"foo\":\"bar\"}",
       "@version" => "1",
     "@timestamp" => "2015-08-03T10:26:20.266Z",
           "host" => "igor-rg.local",
    "jsoninsides" => "{ \"foo\":\"bar\" }"
}

shell.sh

cat broken.json | logstash -f testconf.conf --debug
cat fixed.json | logstash -f testconf.conf --debug

testconf.conf

input {
   stdin {
  }
}

filter{
  grok {
      match => ["message", "^.*?\{%{GREEDYDATA:jsoninsides}\}"]
  }
  mutate {
      replace => [ "jsoninsides", "{ %{jsoninsides} }" ]
  }
}
output {
      stdout { codec => rubydebug }
}