# I want to remove "" in pipeline

**URL:** <https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024>\
**Category:** Kibana\
**Created:** [September 26, 2018, 1:36pm UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024 "2018-09-26T13:36:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rkiers](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@Rkiers](https://discuss.elastic.co/u/Rkiers)\
**Post date:** [September 26, 2018, 1:36pm UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/1 "2018-09-26T13:36:45Z")

</div>

I got a file I want to import into Kibana using elasticsearch but in one of the fields it uses "" how can i remove them?

Roedolf

---

<div class="post-metadata">

**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\
**Post date:** [September 26, 2018, 6:32pm UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/2 "2018-09-26T18:32:55Z")

</div>

Can you clarify what you mean? It sounds like you haven't indexed the data into Elasticsearch yet, so you can simply check for the empty value and remove the field before sending the document into Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Rkiers](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@Rkiers](https://discuss.elastic.co/u/Rkiers)\
**Post date:** [September 27, 2018, 6:41am UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/3 "2018-09-27T06:41:31Z")

</div>

I have made a grok pattern for dev tools incl fields, bur when i run a test script it comes up with an error that there is an unexpected character " which contains a part of the data i want to see in the fields ive made

---

<div class="post-metadata">

**Author:** ![Rkiers](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@Rkiers](https://discuss.elastic.co/u/Rkiers)\
**Post date:** [September 27, 2018, 6:42am UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/4 "2018-09-27T06:42:06Z")

</div>

{  
"error": {  
"root\_cause": [  
{  
"type": "parse\_exception",  
"reason": "Failed to parse content to map"  
}  
],  
"type": "parse\_exception",  
"reason": "Failed to parse content to map",  
"caused\_by": {  
"type": "json\_parse\_exception",  
"reason": "Unexpected character ('N' (code 78)): was expecting comma to separate Object entries\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@452d63ce; line: 5, column: 72]"  
}  
},  
"status": 400  
}

this is what the error message looks like

---

<div class="post-metadata">

**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\
**Post date:** [September 27, 2018, 4:31pm UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/5 "2018-09-27T16:31:02Z")

</div>

Could you give an example of the data and the grok pattern?

---

<div class="post-metadata">

**Author:** ![Rkiers](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@Rkiers](https://discuss.elastic.co/u/Rkiers)\
**Post date:** [October 8, 2018, 7:31am UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/6 "2018-10-08T07:31:59Z")

</div>

THe Grok pattern i am using is:  
PUT \_ingest/pipeline/jmeter  
{  
"description": "Ingest pipeline for JMeter Logs",  
"processors": [

{  
"grok": {  
"field": "message",  
"patterns": [  
"%{DATA:Datetime},%{DATA:Elapsed},%{DATA:label},%{DATA:ResponseCode},%{DATA:responseMessage},%{DATA:ThreadName},%{DATA:DataType},%{DATA:Success},%{DATA:FailureMessage},%{DATA:Bytes},%{DATA:SentBytes},%{DATA:GRPThreads},%{DATA:AllThreads},%{DATA:URL},%{DATA:Latency},%{DATA:IdleTime},%{GREEDYDATA:Connect}"

and the data is as follows:  
"24/03/2018 16:03,18325,Login and load portal,200,"Number of samples in transaction : 67 number of failing samples : 0" ,Loadtest PatientPortal 1-1,,TRUE,,1017426,118940,1,1,null,16881,297,3014"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2018, 7:45am UTC](https://discuss.elastic.co/t/i-want-to-remove-in-pipeline/150024/7 "2018-11-05T07:45:56Z")

</div>

Closed on November 5, 2018, 7:45am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.