# Additional // are seen in parsed message after logstash parsed syslog event

**URL:** <https://discuss.elastic.co/t/additional-are-seen-in-parsed-message-after-logstash-parsed-syslog-event/41541>\
**Category:** Logstash\
**Created:** [February 11, 2016, 6:28pm UTC](https://discuss.elastic.co/t/additional-are-seen-in-parsed-message-after-logstash-parsed-syslog-event/41541 "2016-02-11T18:28:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\
**Post date:** [February 11, 2016, 6:28pm UTC](https://discuss.elastic.co/t/additional-are-seen-in-parsed-message-after-logstash-parsed-syslog-event/41541/1 "2016-02-11T18:28:38Z")

</div>

Hello All,

This is my input string : SECU "OTN2.LAB":SHELF-1 001328 SHELF-1:16-02-05,00-15-00

And output parsed message looked like this :  
"syslog\_message" =\> "SECU \"OTN2.LAB\":SHELF-1 001328

Here is my filter looks like :  
filter {  
grok {  
match =\> { "message" =\> "\<[0-9]\*\>%{CIENA\_TIMESTAMP:ciena\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:syslog\_message}"}

```
  remove_field => ["@version", "host", "message", "port"]
}

date {
  target => "@timestamp"
  match => [ "ciena_timestamp",
             "MMM d HH-mm-ss",
             "MMM dd HH-mm-ss" ]
  timezone => "UTC"
}

```

}

Question is : From were its adding unwanted "//" in the parsed message. I dont want them to be present in my parsed message.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\
**Post date:** [February 12, 2016, 1:38am UTC](https://discuss.elastic.co/t/additional-are-seen-in-parsed-message-after-logstash-parsed-syslog-event/41541/2 "2016-02-12T01:38:31Z")

</div>

Any reply on this one ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 12, 2016, 6:44am UTC](https://discuss.elastic.co/t/additional-are-seen-in-parsed-message-after-logstash-parsed-syslog-event/41541/3 "2016-02-12T06:44:40Z")

</div>

> This is my input string : SECU "OTN2.LAB":SHELF-1 001328 SHELF-1:16-02-05,00-15-00

> And output parsed message looked like this :  
> "syslog\_message" =\> "SECU \"OTN2.LAB\":SHELF-1 001328

It looks like you have literal backslashes in your input. Logstash uses [C-like escape sequences](https://en.wikipedia.org/wiki/Escape_sequences_in_C) so any backslash will be written as two backslashes in a double-quoted string like the one above (presumably from a `stdout { codec => rubydebug }` output.

> Any reply on this one ?

Volunteers respond to questions here so please allow for reasonable response times. Seven hours isn't reasonable. If you want quick response times there are paid support options.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/additional-are-seen-in-parsed-message-after-logstash-parsed-syslog-event/41541/4 "2017-07-06T05:11:51Z")

</div>