### Author:  [@arun5635](https://discuss.elastic.co/u/arun5635)
#### Post date: [November 20, 2018, 9:04am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/1 "2018-11-20T09:04:12Z")
Hi All
I am new to the Logstash, I need to remove \ from request and Http\_method
request": ""GET [https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237](https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237) HTTP/2.0""
http\_method": ""GET"
I want like this
request": "GET [https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237](https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237) HTTP/2.0""
http\_method": "GET"
could you please help me?
---
### Author:  [@arun5635](https://discuss.elastic.co/u/arun5635)
#### Post date: [November 20, 2018, 9:05am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/2 "2018-11-20T09:05:35Z")
this is my .conf file
input {
stdin {}
}
filter {
grok {
match =\> {"message" =\> '%{NOTSPACE:request\_type} %{TIMESTAMP\_ISO8601:log\_timestamp} %{NOTSPACE:alb-name} %{NOTSPACE:client} %{NOTSPACE:target} %{NOTSPACE:request\_processing\_time:float} %{NOTSPACE:target\_processing\_time:float} %{NOTSPACE:response\_processing\_time:float} %{NOTSPACE:elb\_status\_code} %{NOTSPACE:target\_status\_code} %{NOTSPACE:received\_bytes:float} %{NOTSPACE:sent\_bytes:float} %{QUOTEDSTRING:request} %{QUOTEDSTRING:user\_agent} %{NOTSPACE:ssl\_cipher} %{NOTSPACE:ssl\_protocol} %{NOTSPACE:target\_group\_arn} %{QUOTEDSTRING:trace\_id}'}
}
grok{
match =\> ["request", "^(%{NOTSPACE:http\_method})? (%{NOTSPACE:http\_uri})?"]
}
grok{
match =\> ["target\_group\_arn","(?\[/^])(?.[^/]\*)"]
}
mutate {
convert =\> {
"elb\_status\_code" =\> "integer"
"target\_status\_code" =\> "integer"
}
}
}
output {
stdout {}
}
---
### Author:  [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)
#### Post date: [November 20, 2018, 1:47pm UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/3 "2018-11-20T13:47:28Z")
Your examples are the same apart from extra quotes?
---
### Author:  [@arun5635](https://discuss.elastic.co/u/arun5635)
#### Post date: [November 21, 2018, 5:16am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/4 "2018-11-21T05:16:41Z")
sorry forget add backlash
> [@arun5635](#):
>
> request": ""GET [https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237](https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237) HTTP/2.0""
> http\_method": ""GET"
>
> I want like this
> request": "GET [https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237](https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237) HTTP/2.0""
> http\_method": "GET"
---
### Author:  [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)
#### Post date: [November 21, 2018, 8:07am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/5 "2018-11-21T08:07:09Z")
I still cannot see a difference in the examples
---
### Author:  [@arun5635](https://discuss.elastic.co/u/arun5635)
#### Post date: [November 21, 2018, 10:14am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/6 "2018-11-21T10:14:01Z")
request": "\"GET [https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237](https://www.docsapp.in/dashboardapp/forward/0/content?patientId=6009237)HTTP/2.0""
http\_method": "\"GET"
I need
request": "GET [https://www.docsapp.in:443/dashboardapp/forward/0/content?patientId=6009237](https://www.docsapp.in/dashboardapp/forward/0/content?patientId=6009237)HTTP/2.0""
http\_method": "GET"
---
### Author:  [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)
#### Post date: [November 21, 2018, 10:36am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/7 "2018-11-21T10:36:46Z")
Can you give me some raw input example lines? 3 or 4 would be good.
---
### Author:  [@arun5635](https://discuss.elastic.co/u/arun5635)
#### Post date: [November 22, 2018, 9:01am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/8 "2018-11-22T09:01:15Z")
h2 2018-11-15T06:34:59.899131Z app/ecs-production-cluster/1e87a951378c7dd2 1.5d1.e5.1ew9:4w913 172.31.7.248:80 0.000 0.009 0.000 200 200 52 216 "POST [https://www.docsapp.in:443/dashboardapp/forward/users](https://www.docsapp.in:443/dashboardapp/forward/users) HTTP/2.0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-west-2:514:targetgroup/docsapp-release-tg/831ff227855 "Root=1-5bed1393-32203aa0d2b3c1a0d0e13c7e" "www.docsapp.in" "arn:aws:iam::547500:server-certificate/RenewedSSL" 6 2018-11-15T06:34:59.889000Z "forward" "-" "-
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2018, 9:01am UTC](https://discuss.elastic.co/t/how-to-remove-in-logstash/157504/9 "2018-12-20T09:01:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.