# Hex Character removal using logstash

**URL:** <https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278>\
**Category:** Logstash\
**Created:** [March 26, 2020, 8:05pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278 "2020-03-26T20:05:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![waqas\_rasheed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqas_rasheed/32/65144_2.png) [@waqas\_rasheed](https://discuss.elastic.co/u/waqas_rasheed)\
**Post date:** [March 26, 2020, 8:05pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/1 "2020-03-26T20:05:46Z")

</div>

Hi,  
I am transferring NGINX logs from filebeat to logstash and than to Kibana but i am not getting desired output as response\_body contains hex characters and i don't know how to remove them using logstash.

Current response\_request -  
\x22userId\x22: \x22u-asds-fds3-s14-asd-sgsdf\x22,\x0A \x22variables\x22: {\x0A \x22Be\_asda\_Bands\x22: \x22asd\_d0d5\x22,\x0A \x22Be\_asda\_Postroll\_Bands\x22: \x22asda\_asda\_123l\_dx\x22,\x0A \x22Be\_Daily\_Contest\_Bundles\x22: \x22asn-asd-asd-v2\x22,\x0A \x22Be\_Adgem\_Enabled\x22: \x22FALSE\x22,\x0A \x22Be\_Ad\_Supsadn\_Tsad\_Boasdth\x22: \x22\x22,\x0A \x22Be\_Ad\_Casdnce\x22: \x22cadence\_d0\_d10\_2\x22,\x0A \x22Be\_Basdus\_Tasder\x22: \x2210\x22,\x0A \x22Be\_asd\_Psadoll\x22: \x22asdasd\_asdl\x22,\x0A \x22Be\_ltsadck\x22: \x22default\x22 }\x0A}"

Desired output -  
"userId": "u-asds-fds3-s14-asd-sgsdf",  
"variables": {  
"Be\_asda\_Bands": "asd\_d0d5",  
"Be\_asda\_Postroll\_Bands": "asda\_asda\_123l\_dx",  
"Be\_Daily\_Contest\_Bundles": "asn-asd-asd-v2",  
"Be\_Adgem\_Enabled": "FALSE",  
"Be\_Ad\_Supsadn\_Tsad\_Boasdth": "",  
"Be\_Ad\_Casdnce": "cadence\_d0\_d10\_2",  
"Be\_Basdus\_Tasder": "10",  
"Be\_asd\_Psadoll": "asdasd\_asdl",  
"Be\_ltsadck": "default" }  
}"

P.S : I have to implement this in logstash.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 26, 2020, 8:49pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/2 "2020-03-26T20:49:25Z")

</div>

Why not just use mutate+gsub to do the substitution?

---

<div class="post-metadata">

**Author:** ![waqas\_rasheed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqas_rasheed/32/65144_2.png) [@waqas\_rasheed](https://discuss.elastic.co/u/waqas_rasheed)\
**Post date:** [March 26, 2020, 8:54pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/3 "2020-03-26T20:54:29Z")

</div>

I have tried but it is not working properly in my case.

This is working fine and substituting \x22.  
mutate {  
gsub =\> ["resp\_body", "\x22 " , ""]  
}

But this is not substituting \x0A and i don't know why its not working for this.  
mutate {  
gsub =\> ["resp\_body", "\x0A " , ""]  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 26, 2020, 8:56pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/4 "2020-03-26T20:56:17Z")

</div>

Is there a space after the \0A in [resp\_body]? You appear to have one in your regexp.

---

<div class="post-metadata">

**Author:** ![waqas\_rasheed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqas_rasheed/32/65144_2.png) [@waqas\_rasheed](https://discuss.elastic.co/u/waqas_rasheed)\
**Post date:** [March 26, 2020, 9:06pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/5 "2020-03-26T21:06:21Z")

</div>

Mya be it comes in copy paste this chunk but i have tried it with space and without space but it didn't work only for \x0A

---

<div class="post-metadata">

**Author:** ![waqas\_rasheed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqas_rasheed/32/65144_2.png) [@waqas\_rasheed](https://discuss.elastic.co/u/waqas_rasheed)\
**Post date:** [March 26, 2020, 9:13pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/6 "2020-03-26T21:13:53Z")

</div>

Issue resolve by adding one more slash. I dont know why it worked but it works.

mutate {  
gsub =\> ["resp\_body", "\\x0A " , ""]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2020, 9:14pm UTC](https://discuss.elastic.co/t/hex-character-removal-using-logstash/225278/7 "2020-04-23T21:14:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.