# Parse out #012 from data

**URL:** <https://discuss.elastic.co/t/parse-out-012-from-data/165782>\
**Category:** Logstash\
**Created:** [January 25, 2019, 1:27pm UTC](https://discuss.elastic.co/t/parse-out-012-from-data/165782 "2019-01-25T13:27:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![reswob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reswob/32/38015_2.png) [@reswob](https://discuss.elastic.co/u/reswob)\
**Post date:** [January 25, 2019, 1:27pm UTC](https://discuss.elastic.co/t/parse-out-012-from-data/165782/1 "2019-01-25T13:27:05Z")

</div>

I have some data I'm sending via syslog to LS. It is json when it is collected:

```
{
    "updated_date": null,
    "status": null,
    "name": null,
    "dnssec": null,
    "city": null,
    "expiration_date": null,
    "address": null,
    "zipcode": null,
    "creation_date": null,
    "domain_name": null,
    "whois_server": null,
    "state": null,
    "registrar": null,
    "referral_url": null,
    "cached_on": "2019-01-24 08:08:52.560499",
    "name_servers": null,
    "org": null,
    "country": null,
    "emails": null,
    "cache_question": "ex.com"

```

and when it arrives at LS it has #012 where the lines ended:

```
{#012 "updated_date": null, #012 "status": null, #012 "name": null, #012 "dnssec": null, #012 "city": null, #012 "expiration_date": null, #012 "address": null, #012 "zipcode": null, #012 "creation_date": null, #012 "domain_name": null, #012 "whois_server": null, #012 "state": null, #012 "registrar": null, #012 "referral_url": null, #012 "cached_on": "2019-01-24 08:08:52.560499", #012 "name_servers": null, #012 "org": null, #012 "country": null, #012 "emails": null, #012 "cache_question": "ex.com"#012}}

```

When I try to parse this with the json filter, I get \_jsonparsefailure. I tried mutate - gsub to remove it, but does not seem to work

```
mutate {
   gsub => ["message","#012 ",""]
}

```

I found some other discussions that talked about removing ff or lf, but they had \n and \r in their text. Searches so far have not found anyone having this problem.

Has anyone seen this or seen other forum discussions that solved this?

Thanks

---

<div class="post-metadata">

**Author:** ![reswob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reswob/32/38015_2.png) [@reswob](https://discuss.elastic.co/u/reswob)\
**Post date:** [January 25, 2019, 1:31pm UTC](https://discuss.elastic.co/t/parse-out-012-from-data/165782/2 "2019-01-25T13:31:19Z")

</div>

Aaaannnddddd..... five seconds later I figured it out.

Sorry to the wasted bits.

```auto
mutate {
   gsub => ["message","#012",""]
}

```

was the right syntax.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2019, 1:44pm UTC](https://discuss.elastic.co/t/parse-out-012-from-data/165782/3 "2019-02-22T13:44:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.