Remove backslash from xml log

<soap-env:envelope xmlns:soap-env=\"........ \" xmlns:m2=\".... \".........................</soap-env:envelope>

I wanted to remove the backslashs ("\") in above xml log-line and I have tried

ruby {
code => ' d= event.get("logMsg");
d = d. gsub("\\", " ");'

But, my code does not work, it does not remove the backslashs. If anyone who knows the solution please help me.


mutate {
  gsub => ["logMsg","[\\]",""]

Hi, @Rios Thanks for you reply. Unfortunately, this does not work for my case, it does not remove backslash in the xml tags.

In your case it's related to quotes not to backslash. Strings are always displayed under quotes. How you will display quotes inside string except with backslash+quote
In general, if you remove \ from the string, use next code:

	mutate {
  add_field => { "dir" => "c:\temp\test.txt" }
	mutate {
		gsub => ["dir","[\\]",""]

The result would be:

"dir" => "c:temptest.txt"

There is a workaround for your case, replace double quotes with single quotes, XML will be still valid. I have tested in XMLViewer

mutate {
  gsub => ["temp",'[\"]',"'"]

For instance:
"<?xml version=\"1.0\"?><catalog><book id=\"bk101\"><author>Gambardella, Matthew</author><title>XML Developer's Guide</title></book><book id=\"bk102\"><author>Ralls, Kim</author><title>Midnight Rain</title></book></catalog>"

Will change in:

<?xml version='1.0'?><catalog><book id='bk101'><author>Gambardella, Matthew</author><title>XML Developer's Guide</title></book><book id='bk102'><author>Ralls, Kim</author><title>Midnight Rain</title></book></catalog>

However I wouldn't do any changes.

Badger, do you have any better idea?

Thank you for the solution. It worked for me.

But need to extract some data from xml because of single quote it does not take it as a xml in to find the XPATH again I wanted to replace the single quotes with double quotes

Need result like as below with double quotes

<?xml version="1.0"?><catalog><book id="bk101"><author>Gambardella, Matthew</author><title>XML Developer"s Guide</title></book><book id="bk102"><author>Ralls, Kim</author><title>Midnight Rain</title></book></catalog>

Thanks in Advanced

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.