# Logstash gsub: how to replace with backslash?

**URL:** <https://discuss.elastic.co/t/logstash-gsub-how-to-replace-with-backslash/58364>\
**Category:** Logstash\
**Created:** [August 18, 2016, 3:28pm UTC](https://discuss.elastic.co/t/logstash-gsub-how-to-replace-with-backslash/58364 "2016-08-18T15:28:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [August 18, 2016, 3:28pm UTC](https://discuss.elastic.co/t/logstash-gsub-how-to-replace-with-backslash/58364/1 "2016-08-18T15:28:06Z")

</div>

Hi, I have following stuff in a field:

"field\_A" =\> "c:\\test\\test.txt"

By some conversion the masking backslash became a valid character.  
How can I get rid of the double backslashes, so that I have only one (or two when masked)?

I tried:

mutate  
{  
gsub =\>  
[  
'field\_A', '(\\\\)', '\\'  
]  
}

but that is not accepted by logstash.  
If I try to replace to '[\]' then the brackets are also inserted.

Any idea?  
Thanks a lot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/logstash-gsub-how-to-replace-with-backslash/58364/2 "2017-07-06T04:42:45Z")

</div>