# How to remove special character from string in logstash
**URL:** https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273
**Category:** Logstash
**Created:** [December 7, 2016, 9:48am UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273 "2016-12-07T09:48:38Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@sundar1](https://discuss.elastic.co/u/sundar1)
#### Post date: [December 7, 2016, 9:48am UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/1 "2016-12-07T09:48:38Z")
I'm getting some fields in the kibana like "attributes.host\_mem\_file\_buffer **1.3747773440e+09|g**".
I want to first replace with "|g" to "" and then convert to float value.
I tried below one but it's not replacing "|g" to ""(empty)
mutate {
lowercase =\> ["host"]
gsub =\> ["attributes.host\_mem\_mem\_free", "|g", ""]
gsub =\> ["host\_mem\_mem\_free", "|g", ""]
gsub =\> ["host.mem.mem.free", "|g", ""]
}
Can you please help me how to remove "|g" in the string
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 7, 2016, 10:08am UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/2 "2016-12-07T10:08:24Z")
Since `|` has a special meaning in regular expressions I'd try replacing `\|g` instead.
---
### Author:  [@sundar1](https://discuss.elastic.co/u/sundar1)
#### Post date: [December 7, 2016, 11:09am UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/3 "2016-12-07T11:09:47Z")
Thanks for your reply but not working. Below is my code. Can you please suggest me how to change entire attribute object "|g"
mutate {
lowercase =\> ["host"]
#gsub =\> ["m\_host\_mem\_mem\_free", "|g", ""]
gsub =\> ["m\_host\_mem\_mem\_free", "|g", ""]
}
My Json object is coming into the kibana
{
"\_index": "logstash-metrics-2016.12.07",
"\_type": "json",
"\_id": "AVjY9S9M",
"\_score": null,
"\_source": {
"id": "TL4NDQHCOSX4QEJP42C5KCJ23WS74NH====",
"body": "",
"host": "vc2..com",
"source": "",
"ts": 1481089953634,
"location": "RTP",
"service": "metrics",
"event\_type\_id": 107,
"attributes": {
"m\_host\_mem\_mem\_cache": "2.0229201920e+09|g",
"m\_host\_mem\_mem\_free": "3.8571212800e+09|g",
"m\_host\_mem\_free\_mem\_swap": "1.9327344640e+10|g",
"m\_host\_mem\_file\_buffer": "8.2237849600e+08|g",
"m\_host\_mem\_mem\_total": "8.0994344960e+09|g",
"m\_host\_mem\_mem\_swap": "1.9327344640e+10|g"
},
"@version": "1",
"@timestamp": "2016-12-07T11:04:56.335Z",
"type": "json"
},
"fields": {
"@timestamp": [
1481108696335
]
},
"sort": [
1481108696335
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 7, 2016, 11:47am UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/4 "2016-12-07T11:47:20Z")
The field name isn't `m_host_mem_mem_free`, it's `[attributes][m_host_mem_mem_free]`.
---
### Author:  [@sundar1](https://discuss.elastic.co/u/sundar1)
#### Post date: [December 7, 2016, 12:00pm UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/5 "2016-12-07T12:00:07Z")
Is below format is correct?
gsub =\> ["[attributes][m\_host\_mem\_mem\_free]", "|g", "" ]
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 7, 2016, 12:03pm UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/6 "2016-12-07T12:03:27Z")
That looks correct, yes.
---
### Author:  [@sundar1](https://discuss.elastic.co/u/sundar1)
#### Post date: [December 14, 2016, 1:32pm UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/7 "2016-12-14T13:32:25Z")
Thanks a lot it works.
gsub =\> ["[\_source][attributes][m\_host\_mem\_mem\_free]", "|g", "" ]
convert =\> { "[\_source][attributes][m\_host\_mem\_mem\_free]" =\> "float" }
---
### Author:  [@sundar1](https://discuss.elastic.co/u/sundar1)
#### Post date: [December 19, 2016, 1:19pm UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/8 "2016-12-19T13:19:51Z")
I have another question related to same . I have 100 filed names values like "|g" and field names come like below
"attributes": {
"m\_host\_mem\_mem\_cache": "2.0229201920e+09|g",
"m\_host\_mem\_mem\_free": "3.8571212800e+09|g",
"m\_host\_mem\_free\_mem\_swap": "1.9327344640e+10|g",
"m\_host\_mem\_file\_buffer": "8.2237849600e+08|g",
"m\_host\_mem\_mem\_total": "8.0994344960e+09|g",
"m\_host\_mem\_mem\_swap": "1.9327344640e+10|g"
},
How can I use iterator and dynamic replacement "|g" with empty and convert the float. Please give me solution.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 19, 2016, 1:35pm UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/9 "2016-12-19T13:35:49Z")
I'm pretty sure you have to use a ruby filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2017, 1:35pm UTC](https://discuss.elastic.co/t/how-to-remove-special-character-from-string-in-logstash/68273/10 "2017-01-16T13:35:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.