# Remove a character with gsub

**URL:** <https://discuss.elastic.co/t/remove-a-character-with-gsub/207570>\
**Category:** Logstash\
**Created:** [November 12, 2019, 6:31pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570 "2019-11-12T18:31:01Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 12, 2019, 6:31pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/1 "2019-11-12T18:31:02Z")

</div>

Hello there

Im generating new field based on this entry a serial number and a status  
34401910175945 ,ON

The with this regular expression  
(?\<serial\_number\>.\*[0-9])\s(?\<my\_status\>[^,].\w+)

I get

```
{
  "serial_number": [
    "34401910175945"
  ],
  "my_status": [
    ",ON"
  ]
}

```

But am not being able to remove the coma ( , ) character, what am I missing?  
Thanks

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [November 12, 2019, 6:51pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/2 "2019-11-12T18:51:05Z")

</div>

You could use split [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split)

```auto
filter {
      mutate {
         split => { "fieldname" => " ," }
      }
    }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 12, 2019, 7:03pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/3 "2019-11-12T19:03:27Z")

</div>

Don't include it in the capture group, put it next to the \s preceding the second capture group.

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 12, 2019, 7:31pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/4 "2019-11-12T19:31:31Z")

</div>

@philippkahr  
Thanks for your help, now Im getting this

```
    "my_status": [
          "",
          "ON"

```

From logstash log I see this

```
    "my_status" => [
            [0] "",
            [1] "ON"

```

The coma is not removed should it be?  
Can I do something like update =\> { "my\_status" =\> "%my\_status[1]" } ?  
Regards

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [November 12, 2019, 7:34pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/5 "2019-11-12T19:34:37Z")

</div>

The `,` you are mentioning is just json notation, so that has to be there 🙂

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 12, 2019, 7:57pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/6 "2019-11-12T19:57:56Z")

</div>

@philippkahr  
You are right, so , back to my question, how can I remove the ( , ) from the field to have something like this?

"my\_status": "ON",

My regular expression seems to be bad, Im creating a temporary field like this:

```
  mutate {
           copy => { "message" => "message_tmp" }
      }

grok {
              match => {
                    "message_tmp" => "(?<serial_number>.*[0-9])\s(?<my_status>[^,].\w+)"

```

Thank you!  
Regards

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [November 12, 2019, 8:10pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/7 "2019-11-12T20:10:54Z")

</div>

> [@Kernel\_Panic](#):
>
> update =\> { "my\_status" =\> "%my\_status[1]" } ?

```auto
replace => {
  { "my_status" => "%{my_status[1]}" }
}

```

So your entire pipeline would be something like this (pseudocode)

```auto
 mutate {
           copy => { "message" => "message_tmp" }
      },
mutate {
         split => { "fieldname" => " ," }
      },
replace => {
  { "my_status" => "%{my_status[1]}" }
}

```

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 12, 2019, 10:59pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/8 "2019-11-12T22:59:11Z")

</div>

@philippkahr  
Thanks , that did the trick.!!!  
Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2019, 11:04pm UTC](https://discuss.elastic.co/t/remove-a-character-with-gsub/207570/9 "2019-12-10T23:04:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.