# Can't replace character with Backslash with gsub

**URL:** <https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501>\
**Category:** Logstash\
**Created:** [October 23, 2021, 8:45pm UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501 "2021-10-23T20:45:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Hamilton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_hamilton/32/82111_2.png) [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\
**Post date:** [October 23, 2021, 8:45pm UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501/1 "2021-10-23T20:45:43Z")

</div>

Hi all. I am trying to replace the pound character in a field value with the backslash but am truggling to get it to work. The field looks like this:

`PoundedUNC => "##Network#Share#Name$"` and I would like to turn it into `"\\Network\Share\Name$"`

When I use the filter: `mutate { gsub => ["PoundedUNC", "#", "\\"] }`  
It causes logstash to crash. But if I use: `mutate { gsub => ["PoundedUNC", "#", "[\\]"] }`,  
Logstash starts properly but I get the result: `[\][\]Network[\]Share[\]Name$"`

I have tried many combinations but no luck. Any idea on how I can get it to work properly?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 23, 2021, 9:07pm UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501/2 "2021-10-23T21:07:42Z")

</div>

As you have found, you cannot have a backslash as the last character in a quoted string. Using a character group is the normal trick for the pattern. If you use it in the replacement string it is a literal, not a group. So you could do

```
mutate {
    gsub => [
        "PoundedUNC", "#", "\]",
        "PoundedUNC", "]", ""
    ]
}

```

It does not have to be ], you can use any character that will never appear in the UNC.

---

<div class="post-metadata">

**Author:** ![Bryan\_Hamilton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_hamilton/32/82111_2.png) [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\
**Post date:** [October 24, 2021, 10:35am UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501/3 "2021-10-24T10:35:09Z")

</div>

Brilliant man!!! It worked like a charm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2021, 10:36am UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501/4 "2021-11-21T10:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.