Remove backslash from xml log

[Jathurshan_Sumandira (Jathurshan Sumandiran)]

<soap-env:envelope xmlns:soap-env=\"........ \" xmlns:m2=\".... \".........................</soap-env:envelope>

I wanted to remove the backslashs ("\") in above xml log-line and I have tried

ruby {
code => ' d= event.get("logMsg");
d = d. gsub("\\", " ");'
}

But, my code does not work, it does not remove the backslashs. If anyone who knows the solution please help me.

[Rios]

Add:

mutate {
  gsub => ["logMsg","[\\]",""]
}

[Jathurshan_Sumandira (Jathurshan Sumandiran)]

Hi, @Rios Thanks for you reply. Unfortunately, this does not work for my case, it does not remove backslash in the xml tags.

[Rios]

In your case it's related to quotes not to backslash. Strings are always displayed under quotes. How you will display quotes inside string except with backslash+quote
In general, if you remove \ from the string, use next code:

	mutate {
  add_field => { "dir" => "c:\temp\test.txt" }
	}
	mutate {
		gsub => ["dir","[\\]",""]
	}

The result would be:

"dir" => "c:temptest.txt"

There is a workaround for your case, replace double quotes with single quotes, XML will be still valid. I have tested in XMLViewer

mutate {
  gsub => ["temp",'[\"]',"'"]
}

For instance:
"<?xml version=\"1.0\"?><catalog><book id=\"bk101\"><author>Gambardella, Matthew</author><title>XML Developer's Guide</title></book><book id=\"bk102\"><author>Ralls, Kim</author><title>Midnight Rain</title></book></catalog>"

Will change in:

<?xml version='1.0'?><catalog><book id='bk101'><author>Gambardella, Matthew</author><title>XML Developer's Guide</title></book><book id='bk102'><author>Ralls, Kim</author><title>Midnight Rain</title></book></catalog>

However I wouldn't do any changes.

Badger, do you have any better idea?

[Jathurshan_Sumandira (Jathurshan Sumandiran)]

Thank you for the solution. It worked for me.

But need to extract some data from xml because of single quote it does not take it as a xml in to find the XPATH again I wanted to replace the single quotes with double quotes

Need result like as below with double quotes

<?xml version="1.0"?><catalog><book id="bk101"><author>Gambardella, Matthew</author><title>XML Developer"s Guide</title></book><book id="bk102"><author>Ralls, Kim</author><title>Midnight Rain</title></book></catalog>

Thanks in Advanced