# How to remove extra characters by using grok pattern in logstash

**URL:** https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187
**Category:** Logstash
**Created:** [August 20, 2024, 9:59am UTC](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187 "2024-08-20T09:59:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![upreddy](https://avatars.discourse-cdn.com/v4/letter/u/f04885/32.png) [@upreddy](https://discuss.elastic.co/u/upreddy)
#### Post date: [August 20, 2024, 9:59am UTC](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187/1 "2024-08-20T09:59:16Z")

</div>

Hi  
I trying to write grok pattern to remove some extra characters in between the message by using grok pattern. after removing these extra characters i want to apply json filter. **I am sharing sample logs below.**

2024-08-20T08:55:03.642963576Z stdout F 08:55:03.642 [xxxx-qwe-9090-exec-8] INFO com.xxxx.vnb.abconvert.ABCVDGontroller - {"logtype":"abc","component":"jkl","request":{"method":"POST","path":"/ops","headers":{"test":"artyucff"}},"response":{"status":400},"runtimes":{"totalTime":12}}

**I want to remove below portion from above message**  
08:55:03.642 [http-qwe-9090-exec-8] INFO com.xxxx.vnb.abconvert.ABCVDGontroller -

**I am sharing created grok pattern below.**  
%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{WORD:[@metadata][logoutputtype]}%{SPACE}%{WORD:[@metadata][loglevel]}%{SPACE}%{DATA:[@metadata]%{SPACE}-%{SPACE}} %{GREEDYDATA:jsonmessage}"

Could you please guide me to crate grok pattern for above message?

---

<div class="post-metadata">

### Author: ![kishorkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorkumar/32/132930_2.png) [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)
#### Post date: [August 20, 2024, 10:19am UTC](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187/2 "2024-08-20T10:19:07Z")

</div>

> [@upreddy](#):
>
> 2024-08-20T08:55:03.642963576Z stdout F 08:55:03.642 [xxxx-qwe-9090-exec-8] INFO com.xxxx.vnb.abconvert.ABCVDGontroller - {"logtype":"abc","component":"jkl","request":{"method":"POST","path":"/ops","headers":{"test":"artyucff"}},"response":{"status":400},"runtimes":{"totalTime":12}}

You can remove extra info

```auto
POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "Parse log message to JSON",
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            """%{TIMESTAMP_ISO8601:timestamp}Z stdout %{WORD:log_level} %{TIME:time} \\[%{DATA:thread_name}\\] %{LOGLEVEL:level} %{JAVACLASS:logger} - %{GREEDYDATA:json_message}"""
          ]
        }
      },
      {
        "json": {
          "field": "json_message",
          "target_field": "json_data"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": """2024-08-20T08:55:03.642963576Z stdout F 08:55:03.642 [xxxx-qwe-9090-exec-8] INFO com.xxxx.vnb.abconvert.ABCVDGontroller - {"logtype":"abc","component":"jkl","request":{"method":"POST","path":"/ops","headers":{"test":"artyucff"}},"response":{"status":400},"runtimes":{"totalTime":12}}"""
      }
    }
  ]
}

```

---

<div class="post-metadata">

### Author: ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [August 20, 2024, 11:25am UTC](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187/3 "2024-08-20T11:25:16Z")

</div>

> [@upreddy](#):
>
> %{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{WORD:[@metadata][logoutputtype]}%{SPACE}%{WORD:[@metadata][loglevel]}%{SPACE}%{DATA:[@metadata]%{SPACE}-%{SPACE}} %{GREEDYDATA:jsonmessage}"

Hi,

try with this:

%{TIMESTAMP\_ISO8601:timestamp} %{WORD:[@metadata][logoutputtype]} F %{DATA:[@metadata][discard]} - %{GREEDYDATA:jsonmessage}

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/6/46942da2c0bac25eea14a8a9e69bdf989fb01fc0.png)

Regards

---

<div class="post-metadata">

### Author: ![upreddy](https://avatars.discourse-cdn.com/v4/letter/u/f04885/32.png) [@upreddy](https://discuss.elastic.co/u/upreddy)
#### Post date: [August 20, 2024, 3:02pm UTC](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187/4 "2024-08-20T15:02:41Z")

</div>

> [@yago82](#):
>
> %{TIMESTAMP\_ISO8601:timestamp} %{WORD:[@metadata][logoutputtype]} F %{DATA:[@metadata][discard]} - %{GREEDYDATA:jsonmessage}

Hi yago,  
Thanks for replying. It is working fine 🙂

Thanks  
upendar