# Parse syslog with filepath backslashes
**URL:** https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919
**Category:** Logstash
**Created:** [April 16, 2026, 11:10am UTC](https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919 "2026-04-16T11:10:14Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Adrian\_Wallis](https://discuss.elastic.co/u/Adrian_Wallis)
#### Post date: [April 16, 2026, 11:10am UTC](https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919/1 "2026-04-16T11:10:14Z")
Hello,
I have some syslogs to parse which are in a very basic comma delimited format. Everything looks and works fine apart from a file path with backslashes.
I've seen several suggestions on the forum around mutate and gsub but I've no idea where to put them!
Below is an example in the elastic Dev Tools section for Security Onion
```auto
POST _ingest/pipeline/_simulate
{
"pipeline": {
"description": "logparsetest",
"processors": [
{
"dissect": {
"field": "message",
"pattern" : "%{Junk1},%{Junk2},%{FilePath},%{SomethingElse}"
}
}
]
},
"docs": [
{
"_source": {
"message": "Junk1,Junk2,c:\somepath\example.exe,se"
}
}
]
}
```
Can someone please advise where I would put the processing in the above to fix the error 'Unrecognized character escape'?
Many thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 16, 2026, 3:09pm UTC](https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919/2 "2026-04-16T15:09:58Z")
Do you want to do this with logstash or an elasticsearch ingest pipeline? If the latter then move this to the elasticsearch forum.
---
### Author:  [@Adrian\_Wallis](https://discuss.elastic.co/u/Adrian_Wallis)
#### Post date: [April 28, 2026, 2:28pm UTC](https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919/3 "2026-04-28T14:28:55Z")
Hello Badger,
Sorry for the delay in replying, I've been away for a couple of weeks.
I don't really know the answer to your question, but it might make more sense if I provide some context.
We have logs being shipped from Zscaler ZPA into Security Onion and have the Elastic integration (www-elastic-co/docs/reference/integrations/zscaler\_zpa) configured and working. This parses some data such as User Activity (help-zscaler-com/zpa/understanding-user-activity-log-fields) but does not currently support/parse Microsegmention flows which are part of the same log shipping (help-zscaler-com/zpa/understanding-microsegmentation-flow-log-fields).
I know virtually nothing about Elastic/Security Onion as it was set up by a previous employee (lucky me), but I don't think the working logs are using logstash - I may be wrong, this is just based on the fact 'logstash' isn't mentioned in the security onion 'tags' field.
For reference, the 'tags' on a user activity entry which is being parsed are:
[forwarded, zscaler\_zpa-user\_activity, elastic-agent, input-servername, beats\_input\_codec\_plain\_applied, user\_activity]
and the tags on a non-parsed syslog entry for the microsegmentation are:
[syslog, elastic-agent, input-servername, beats\_input\_codec\_plain\_applied, syslog]
Most likely I'll have to wait and hope whoever looks after the integrations adds microsegmentation support, but I thought I'd try and see if it's possible myself.