# How to remove only one character from string using GSUB?

**URL:** <https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962>\
**Category:** Logstash\
**Created:** [September 30, 2016, 8:58pm UTC](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962 "2016-09-30T20:58:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chromechris](https://avatars.discourse-cdn.com/v4/letter/c/e47c2d/32.png) [@chromechris](https://discuss.elastic.co/u/chromechris)\
**Post date:** [September 30, 2016, 8:58pm UTC](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962/1 "2016-09-30T20:58:59Z")

</div>

Ok, so the issue I have is I want to remove a character once from a field value, and this specific character that I want to remove appears multiple times in the field value. I don't want to remove this character from all it's occurences in the field value, I just want to remove it once.

Example:  
String: Boom,.lfoel.dk.ksjkd;'.s87.^5..  
Remove the first "." only, leave the rest alone

Thanks in advance fellow Loggers,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 3, 2016, 5:36am UTC](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962/2 "2016-10-03T05:36:23Z")

</div>

You can't do this with gsub. Your best bet is a ruby filter or a grok filter. The latter could match everything up to the first occurrence of the character, then the character itself, then the rest. Afterwards you could string together the two pieces you captured.

---

<div class="post-metadata">

**Author:** ![chromechris](https://avatars.discourse-cdn.com/v4/letter/c/e47c2d/32.png) [@chromechris](https://discuss.elastic.co/u/chromechris)\
**Post date:** [October 3, 2016, 11:30pm UTC](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962/3 "2016-10-03T23:30:50Z")

</div>

Thanks Magnus! Your awesome!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962/4 "2017-07-06T04:35:59Z")

</div>

Closed on July 6, 2017, 4:35am UTC