# Add Execption for special character from json log **URL:** \ **Category:** Logstash\ **Created:** [June 29, 2016, 1:34pm UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285 "2016-06-29T13:34:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![infinitetutts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/infinitetutts/32/10632_2.png) [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\ **Post date:** [June 29, 2016, 1:34pm UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/1 "2016-06-29T13:34:30Z")
Hey Guys, I have been having a few frustrating days trying to crack this. I please need a solution either to fix the Ruby code or another method to add an exception for the escape character which is '\\x'. Logstash filter: > filter { > if [type] == "apache" { > json { > source =\> "message" > } > ruby { > code =\> "event['message'] = event['message'].gsub('\\x','blah')" > } > } > } Example of a Logstash error log: > {:timestamp=\>"2016-06-29T14:02:16.547000+0100", :message=\>"Error parsing json", :source=\>"message", :raw=\>"{ "@version": "1", "@timestamp": "2016-06-29T02:36:49.000+0100", "message": "GET /meizu/q-sa%C4%BAe/?page=47 HTTP/1.1", "via": "123.123.123.123", "client-ip": "12.12.12.12", "remote-logname": "-", "remote-user": "-", "recv-time": "[29/Jun/2016:02:36:49 +0100]", "serve-time-microsec": "102880", "request": "GET /meizu/q-sa%C4%BAe/?page=47 HTTP/1.1", "status": "200", "size": "191150", "referer": "-", "user-agent": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", "url": "/meizu/q-sa\xc4\\xbae/", "query": "?page=47", "method": "GET", "protocol": "HTTP/1.1", "vhost": "www.site.com" }", :exception=\>#\ { "@version": "1", "@timestamp": "2016-06-29T00:58:20.000+0100", "message": "GET /steel/q-sa%C4%BAe/?page=337 HTTP/1.1", "via": "123.123.123.123", "client-ip": "12.12.12.12", "remote-logname": "-", "remote-user": "-", "recv-time": "[29/Jun/2016:00:58:20 +0100]", "serve-time-microsec": "405295", "request": "GET /steel/q-sa%C4%BAe/?page=337 HTTP/1.1", "status": "200", "size": "196565", "referer": "-", "user-agent": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", "url": "/steel/q-sa\xc4\xbae/", "query": "?page=337", "method": "GET", "protocol": "HTTP/1.1", "vhost": "[www.site.com](http://www.site.com)" } Any help would be greatly appreciated ! ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [June 29, 2016, 3:07pm UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/2 "2016-06-29T15:07:52Z")
The problem is that those escape characters are not valid JSON. There may be some work done to help when these conditions occur, but there is no out of the box fix for these situations right now. You might try using a gsub _before_ running the json filter, as filters are applied in the order in which they appear. ---
**Author:** ![infinitetutts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/infinitetutts/32/10632_2.png) [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\ **Post date:** [June 30, 2016, 1:35pm UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/3 "2016-06-30T13:35:56Z")
I have tried the following and then I dont get any output. As soon as I remove the ruby code the logs display on Kibana or the log file. ``` filter { if [type] == "apache" { ruby { code => " if event['message'] event['message'] = event['message'].gsub('\x','Xx') event['message'] = event['message'].gsub('\\x','XXx') end " } json { source => "message" } } } ``` ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [June 30, 2016, 1:50pm UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/4 "2016-06-30T13:50:18Z")
I just tested you filter like this: ##Test.conf input { file { path =\> ["/root/input.txt"] start\_position =\> "beginning" } } filter { ruby { code =\> " if event['message'] event['message'] = event['message'].gsub('\x','Xx') event['message'] = event['message'].gsub('\x','XXx') end " } ``` json { source => "message" } ``` } output { stdout { codec =\> rubydebug } } And the output seems ok ##Output root@loganalyse3:~# /opt/logstash/bin/logstash -f test.conf Settings: Default pipeline workers: 4 Pipeline main started { "message" =\> "GET /steel/q-sa%C4%BAe/?page=337 HTTP/1.1", "@version" =\> "1", "@timestamp" =\> "2016-06-28T23:58:20.000Z", "path" =\> "/root/input.txt", "host" =\> "loganalyse3", "via" =\> "123.123.123.123", "client-ip" =\> "12.12.12.12", "remote-logname" =\> "-", "remote-user" =\> "-", "recv-time" =\> "[29/Jun/2016:00:58:20 +0100]", "serve-time-microsec" =\> "405295", "request" =\> "GET /steel/q-sa%C4%BAe/?page=337 HTTP/1.1", "status" =\> "200", "size" =\> "196565", "referer" =\> "-", "user-agent" =\> "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", **"url" =\> "/steel/q-saXxc4Xxbae/",** "query" =\> "?page=337", "method" =\> "GET", "protocol" =\> "HTTP/1.1", "vhost" =\> "[www.site.com](http://www.site.com)" } ---
**Author:** ![infinitetutts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/infinitetutts/32/10632_2.png) [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\ **Post date:** [July 1, 2016, 7:59am UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/5 "2016-07-01T07:59:24Z")
It is working thank you very much !! I had to wait a few minutes for my logs to populate in Kibana! ---
**Author:** ![infinitetutts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/infinitetutts/32/10632_2.png) [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\ **Post date:** [July 4, 2016, 1:59pm UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/6 "2016-07-04T13:59:37Z")
This method does not work. I reformatted my logs to standard combined apache logs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/add-execption-for-special-character-from-json-log/54285/7 "2017-07-06T04:49:44Z")