# Problem with replace some char using RegExp. under mutate/gsub **URL:** \ **Category:** Logstash\ **Created:** [August 7, 2018, 8:14am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273 "2018-08-07T08:14:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![richard20427176](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@richard20427176](https://discuss.elastic.co/u/richard20427176)\ **Post date:** [August 7, 2018, 8:14am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273/1 "2018-08-07T08:14:11Z")
Hi Guys, I meet some problem when I use logstash to parse some data from the nginx logs. I have the log content as below: ``` {"reqtime":"06/Aug/2018:09:02:17 +0800", "reqbody":"------WebKitFormBoundaryM2dvVjK2xtgaOP6a\r\nContent-Disposition: form-data; name=\"aaa\"\r\n\r\n1111\r\n------WebKitFormBoundaryM2dvVjK2xtgaOP6a\r\nContent-Disposition: form-data; name=\"bbb\"\r\n\r\n五5六6七7八8\r\n------WebKitFormBoundaryM2dvVjK2xtgaOP6a\r\nContent-Disposition: form-data; name=\"ccc\"\r\n\r\n{'xxx':5555, 'yyyy':6666}\r\n------WebKitFormBoundaryM2dvVjK2xtgaOP6a--\r\n", "status":"200"} {"reqtime":"06/Aug/2018:10:29:08 +0800", "reqbody":"{\"databody\":{\"certNo\":\"41011112340222456X\",\"customerId\":31795539663626902,\"dataFrom\":\"baiqishi\",\"eventType\":\"login\",\"mobile\":\"13681881234\",\"name\":\"李飞\"},\"channel\":\"bqssdk\",\"bussiness\":\"query\"}", "status":"200"} ``` You can see there are many backslashes in the json-string string, such as in the 2nd json-string piece. So the json-string cannot convert to json object and be processed directly, I use the Logstash config as below: ``` input { file { path => "/data/log/nginx/*/*/*.log" start_position => "beginning" sincedb_path => "/dev/null" } } filter { mutate { gsub => [ "reqbody", "\"{", "{", "reqbody", "}\"", "}" ] gsub => ["reqbody", "[\\\"]", "\""] gsub => ["reqbody", "[\\]", ""] } } output { #stdout { codec => rubydebug } file { path => "/data/log/logstash/%{+YYYYMM}/test.%{+YYYYMMdd}.txt" } } ``` As you see, I have made some convert by using mutate/gsub in filter section, but it seems not working, and the backslashes get much more in output as below: ``` {"host":"0.0.0.0","path":"/data/log/nginx/2018/201808/access.20180806.log","@version":"1","message":"{\"reqtime\":\"06/Aug/2018:10:29:08 +0800\", \"reqbody\":\"{\\\"databody\\\":{\\\"certNo\\\":\\\"41011112340222456X\\\",\\\"customerId\\\":31795539663626902,\\\"dataFrom\\\":\\\"baiqishi\\\",\\\"eventType\\\":\\\"login\\\",\\\"mobile\\\":\\\"13681881234\\\",\\\"name\\\":\\\"李飞\\\"},\\\"channel\\\":\\\"bqssdk\\\",\\\"bussiness\\\":\\\"query\\\"}\", \"status\":\"200\"}","@timestamp":"2018-08-06T23:08:13.742Z"} {"host":"0.0.0.0","path":"/data/log/nginx/2018/201808/access.20180806.log","@version":"1","message":"{\"reqtime\":\"06/Aug/2018:09:02:17 +0800\", \"reqbody\":\"------WebKitFormBoundaryM2dvVjK2xtgaOP6a\\r\\nContent-Disposition: form-data; name=\\\"aaa\\\"\\r\\n\\r\\n1111\\r\\n------WebKitFormBoundaryM2dvVjK2xtgaOP6a\\r\\nContent-Disposition: form-data; name=\\\"bbb\\\"\\r\\n\\r\\n五5六6七7八8\\r\\n------WebKitFormBoundaryM2dvVjK2xtgaOP6a\\r\\nContent-Disposition: form-data; name=\\\"ccc\\\"\\r\\n\\r\\n{'xxx':5555, 'yyyy':6666}\\r\\n------WebKitFormBoundaryM2dvVjK2xtgaOP6a--\\r\\n\", \"status\":\"200\"}","@timestamp":"2018-08-06T23:08:13.713Z"} ``` I have tried some solutions, but I can't resolve it, can you help me? Thanks a lot! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2018, 8:56am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273/2 "2018-08-07T08:56:19Z")
If you want to parse the JSON payload in the `reqbody` field you should use a json filter. ---
**Author:** ![richard20427176](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@richard20427176](https://discuss.elastic.co/u/richard20427176)\ **Post date:** [August 13, 2018, 3:37am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273/3 "2018-08-13T03:37:57Z")
yeah, it's the problem with error JSON fmt, so that I can't parse it at the begin ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 13, 2018, 6:16am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273/4 "2018-08-13T06:16:59Z")
Sorry, I don't understand. The second example you gave seems to contain a valid JSON string in the `reqbody` field. From what I can tell you don't need any mutate filters. ---
**Author:** ![richard20427176](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@richard20427176](https://discuss.elastic.co/u/richard20427176)\ **Post date:** [August 13, 2018, 7:23am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273/5 "2018-08-13T07:23:28Z")
thanks, I have fixed it. I found that the 2nd JSON field is not a valid JSON string too. So I use reg exp to replace some chars. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 10, 2018, 7:23am UTC](https://discuss.elastic.co/t/problem-with-replace-some-char-using-regexp-under-mutate-gsub/143273/6 "2018-09-10T07:23:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.