Hex Character removal using logstash

[waqas_rasheed]

Hi,
I am transferring NGINX logs from filebeat to logstash and than to Kibana but i am not getting desired output as response_body contains hex characters and i don't know how to remove them using logstash.

Current response_request -
\x22userId\x22: \x22u-asds-fds3-s14-asd-sgsdf\x22,\x0A \x22variables\x22: {\x0A \x22Be_asda_Bands\x22: \x22asd_d0d5\x22,\x0A \x22Be_asda_Postroll_Bands\x22: \x22asda_asda_123l_dx\x22,\x0A \x22Be_Daily_Contest_Bundles\x22: \x22asn-asd-asd-v2\x22,\x0A \x22Be_Adgem_Enabled\x22: \x22FALSE\x22,\x0A \x22Be_Ad_Supsadn_Tsad_Boasdth\x22: \x22\x22,\x0A \x22Be_Ad_Casdnce\x22: \x22cadence_d0_d10_2\x22,\x0A \x22Be_Basdus_Tasder\x22: \x2210\x22,\x0A \x22Be_asd_Psadoll\x22: \x22asdasd_asdl\x22,\x0A \x22Be_ltsadck\x22: \x22default\x22 }\x0A}"

Desired output -
"userId": "u-asds-fds3-s14-asd-sgsdf",
"variables": {
"Be_asda_Bands": "asd_d0d5",
"Be_asda_Postroll_Bands": "asda_asda_123l_dx",
"Be_Daily_Contest_Bundles": "asn-asd-asd-v2",
"Be_Adgem_Enabled": "FALSE",
"Be_Ad_Supsadn_Tsad_Boasdth": "",
"Be_Ad_Casdnce": "cadence_d0_d10_2",
"Be_Basdus_Tasder": "10",
"Be_asd_Psadoll": "asdasd_asdl",
"Be_ltsadck": "default" }
}"

P.S : I have to implement this in logstash.

[Badger]

Why not just use mutate+gsub to do the substitution?

[waqas_rasheed]

I have tried but it is not working properly in my case.

This is working fine and substituting \x22.
mutate {
gsub => [ "resp_body", "\x22 " , "" ]
}

But this is not substituting \x0A and i don't know why its not working for this.
mutate {
gsub => [ "resp_body", "\x0A " , "" ]
}

[Badger]

Is there a space after the \0A in [resp_body]? You appear to have one in your regexp.

[waqas_rasheed]

Mya be it comes in copy paste this chunk but i have tried it with space and without space but it didn't work only for \x0A

[waqas_rasheed]

Issue resolve by adding one more slash. I dont know why it worked but it works.

mutate {
gsub => [ "resp_body", "\\x0A " , "" ]
}