# Remove characters in grok

**URL:** https://discuss.elastic.co/t/remove-characters-in-grok/72548
**Category:** Logstash
**Created:** [January 23, 2017, 11:47pm UTC](https://discuss.elastic.co/t/remove-characters-in-grok/72548 "2017-01-23T23:47:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bob-bza](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bob-bza](https://discuss.elastic.co/u/bob-bza)
#### Post date: [January 23, 2017, 11:47pm UTC](https://discuss.elastic.co/t/remove-characters-in-grok/72548/1 "2017-01-23T23:47:18Z")

</div>

i have string like this

[2017-01-23 21:55:13,840] DEBUG [Channel manager on controller 1]: Controller 1 trying to connect to broker 1 (kafka.controller.ControllerChannelManager)  
[2017-01-23 21:55:13,852] DEBUG [Channel manager on controller 1]: Controller 1 trying to connect to broker 3 (kafka.controller.ControllerChannelManager)  
[2017-01-23 21:55:13,856] INFO [Controller-1-to-broker-1-send-thread], Starting (kafka.controller.RequestSendThread)

i was using this regular expression  
^[%{TIMESTAMP\_ISO8601:time}]\s+%{LOGLEVEL:log-level} [%{DATA:class}]%{GREEDYDATA:message}

output:  
message :·Controller·1·trying·to·connect·to·broker·1·(kafka.controller.ControllerChannelManager)  
message :·Controller·1·trying·to·connect·to·broker·3·(kafka.controller.ControllerChannelManager)  
message ,·Starting··(kafka.controller.RequestSendThread)

i was trying to remove ; ,  
issue was for some stringgs have , some have - some have : etc

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 24, 2017, 6:56am UTC](https://discuss.elastic.co/t/remove-characters-in-grok/72548/2 "2017-01-24T06:56:00Z")

</div>

Change

```
%{GREEDYDATA:message}

```

to

```
[,:]\s+%{GREEDYDATA:message}
```

---

<div class="post-metadata">

### Author: ![bob-bza](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bob-bza](https://discuss.elastic.co/u/bob-bza)
#### Post date: [January 24, 2017, 5:06pm UTC](https://discuss.elastic.co/t/remove-characters-in-grok/72548/4 "2017-01-24T17:06:05Z")

</div>

> [@magnusbaeck](#):
>
> GREEDYDATA:message

thanks it works.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2017, 5:06pm UTC](https://discuss.elastic.co/t/remove-characters-in-grok/72548/5 "2017-02-21T17:06:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.