How to remove brackets on grok patterns?

Continuing the discussion from Remove characters in grok:

On the previous post is an example of how to remove "," in grok. I was wondering if there is something to remove the "[,]" as well.

I still don't know if is it's coming from my log file structure, but since I am a beginner at the pipelines I got here to see if theres anything already made to deal with it.

Here is problem the brackets are causing:

What does your pipeline configuration looks like?

You can use the mutate filter to remove the squared brackets.

Something like this:

 mutate { 
    gsub => [ "ID", "[\[\]]", "" ] 
}
1 Like