# Problem to replace field string "|" with mutate gsub filter
**URL:** https://discuss.elastic.co/t/problem-to-replace-field-string-with-mutate-gsub-filter/232116
**Category:** Logstash
**Created:** [May 11, 2020, 9:48pm UTC](https://discuss.elastic.co/t/problem-to-replace-field-string-with-mutate-gsub-filter/232116 "2020-05-11T21:48:49Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@esportuga](https://discuss.elastic.co/u/esportuga)
#### Post date: [May 11, 2020, 9:48pm UTC](https://discuss.elastic.co/t/problem-to-replace-field-string-with-mutate-gsub-filter/232116/1 "2020-05-11T21:48:49Z")
Hello,
My problem has two solutions that I can use. At the moment I am not achieving success in any.
My log
```auto
2020-04-30T13: 48: 17.954 Int 50141 009401EA-1003849D 3553384768 custom_var navigation|4300; 4201; 7001; 8001; 9000
```
**Solution 1**
Try to separate the data after the "|" character:
```auto
grok {
#match => {"message" => "% {TIMESTAMP_ISO8601: log_data_evento}% {SPACE}% {GREEDYDATA: data_log}"}
match => {"message" => "% {TIMESTAMP_ISO8601: timestamp}% {SPACE}% {WORD}% {SPACE}% {NUMBER}% {SPACE}% {NOTSPACE: field1}% {SPACE}% {NUMBER} % {SPACE} custom_var navigation|%{GREEDYDATA: detail} "}
}
```
It didn't work, the grok fails.
**Solution 2**
Grok differently and remove the character "|" with a mutate gsub filter.
I managed to make the grok so that the "detail" field has this value:
```auto
|4300; 4201; 7001; 8001; 9000
```
I tried to replace the character "|" blank with the gsub filter as shown below:
```auto
filter {
mutate {
gsub => ["detail", "|", ""]
}
}
```
However, the character remains intact.
Am I doing something wrong? Any solution?
Thank you
---
### Author:  [@esportuga](https://discuss.elastic.co/u/esportuga)
#### Post date: [May 11, 2020, 10:12pm UTC](https://discuss.elastic.co/t/problem-to-replace-field-string-with-mutate-gsub-filter/232116/3 "2020-05-11T22:12:40Z")
Ok
Im fixed this with
> [@LogStatsh- Grok Filter for Special character in the log file](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360):
>
> Hi, I have the below log pattern in a single line and trying to filter this from massive log using GROK FIlter 2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |||| Report: FINREP |||| ExecutionTime: 200 ms I have used this below grok filter however ( havent build the complete grok yet) however it couldn't identify how to filer the special Character |||| from this; could you please advise on how to capture the special characters |||| …
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2020, 10:19pm UTC](https://discuss.elastic.co/t/problem-to-replace-field-string-with-mutate-gsub-filter/232116/4 "2020-06-08T22:19:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.