# \[Logstash\] Peut-on supprimer un backslash?

**URL:** <https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416>\
**Category:** Discussions en français\
**Created:** [September 27, 2019, 2:21pm UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416 "2019-09-27T14:21:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [September 27, 2019, 2:21pm UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416/1 "2019-09-27T14:21:43Z")

</div>

Bonjour,

J'arrive bien à supprimer plusieurs caractères spéciaux :

```
filter {
  mutate {
    gsub => ["message", "\[", ""]
    gsub => ["message", "\]", ""]
    gsub => ["message", "\(", ""]
    gsub => ["message", "\)", ""]
    gsub => ["message", "\<", ""]
    gsub => ["message", "\>", ""]
    gsub => ["message", "\,", ""]
  }

```

Par contre dès que je veux aussi supprimer un backslash :

```
filter {
  mutate {
    gsub => ["message", "\[", ""]
    gsub => ["message", "\]", ""]
    gsub => ["message", "\(", ""]
    gsub => ["message", "\)", ""]
    gsub => ["message", "\<", ""]
    gsub => ["message", "\>", ""]
    gsub => ["message", "\,", ""]
    gsub => ["message", "\\", ""]
  }

```

Logstahs ne démarre pas :

```
Sep 27 13:51:57 NODE1 logstash[19606]: [2019-09-27T13:51:56,997][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :ex
ception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 40, column 33 (byte 859) after filter {\n mutate {\n gsub => [\"message\", \"\\[\", \"\"]\n gsub => [\"messag
e\", \"\\]\", \"\"]\n gsub => [\"message\", \"\\(\", \"\"] \n gsub => [\"message\", \"\\)\", \"\"]\n gsub => [\"message\", \"\\<\", \"\"]\n gsub => [\"message\", \"\\>\", \"\"]\n gsub => [
 \"message\", \"\\,\", \"\"]\n gsub => [ \"message\", \"\\\\\", \"", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash
-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share
/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `i
nitialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/
logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}

```

Elasticsearch : 7.3.1  
Logstahs : 7.3.1

Merci pour vos retour 🙂

---

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [September 30, 2019, 6:48am UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416/2 "2019-09-30T06:48:25Z")

</div>

Personne pour lever le doute ? 😉

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [September 30, 2019, 7:32am UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416/3 "2019-09-30T07:32:42Z")

</div>

> [@How to replace 'special characters' with a logstash filter](https://discuss.elastic.co/t/how-to-replace-special-characters-with-a-logstash-filter/28240/2):
>
> It seems like logstash has some issues, when it comes to escaping things. See: [https://logstash.jira.com/browse/LOGSTASH-1377](https://logstash.jira.com/browse/LOGSTASH-1377) and for more information. According to: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub) the following should replace backslashes, question marks, hashes and minuses: filter { mutate { gsub =\> [ # replace backslashes, question marks, hashes, and minuses # with a dot "." "fieldname2", "[…

> <https://github.com/logstash-plugins/logstash-filter-mutate/issues/40>
>
> For some reason the log source (which I don't control over) is sending lines wit…h escaped signs:
> 
> \`\`\`
> $ cat notOK\_sample.log
> field1 field2 field3 \\"field 4\\" field5
> \`\`\`
> 
> I'm using the cvs filter as the main matching filter, it works well for the standardized/expected lines:
> 
> \`\`\`
> $ cat OK\_sample.log
> field1 field2 field3 "field 4" field5
> \`\`\`
> 
> In order to normalize the log lines, I thought about applying gsub to look for \`\\"\` and replace to \`"\`, however it doesn't work (attempt 1,2). It does work if I choose other char, space, or nothing though (attempts 3,4).
> \- Attempt # 1
> 
> input line: \`\\"field4\\"\`
> gsub filter: \`\["message", "\\\\\\"", "\\"" \]\`
> 
> Rubydebug: 
> got: \`\\\\\\"field4\\\\\\"\`
> expected: \`\\"field4\\"\`
> \- Attempt # 2
> 
> input line: \`\\"field4\\"\`
> gsub filter: \`\["message", "\\\\\\"", "\\\\"" \]\`
> 
> Rubydebug: 
> got: \`\\\\\\"field4\\\\\\"\`
> expected: \`\\"field4\\"\`
> \- Attempt # 3 
> 
> input line: \`\\"field4\\"\`
> gsub filter: \`\["message", "\\\\\\"", "" \]\`
> 
> Rubydebug: 
> got: \`field4\`
> expected: \`field4\`
> \- Attemp # 4
> 
> input line: \`\\"field4\\"\`
> gsub filter: \`\["message", "\\\\\\"", "x" \]\`
> 
> Rubydebug: 
> got: \`xfield4x\`
> expected: \`xfield4x\`
> 
> Info:
> 
> \`\`\`
> $ ~/logstash-1.5.3/bin/logstash -V
> logstash 1.5.3
> \`\`\`
> 
> \`\`\`
> $ sw\_vers
> ProductName: Mac OS X
> ProductVersion: 10.10.4
> BuildVersion: 14E46
> \`\`\`
> 
> \`\`\`
> $ ruby -v
> ruby 2.0.0p481 (2014-05-08 revision 45883) \[universal.x86\_64-darwin14\]
> \`\`\`

---

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [September 30, 2019, 10:24am UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416/4 "2019-09-30T10:24:59Z")

</div>

Mmmh...strange...

It works with :

```
  mutate {
    gsub => ["message", "[\\]", "."]
  }

```

Backslash are deleted but not replaced by dot even if it should be done.

Problem solved thank you 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2019, 10:25am UTC](https://discuss.elastic.co/t/logstash-peut-on-supprimer-un-backslash/201416/5 "2019-10-28T10:25:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.