# Remove charactes with gstug

**URL:** <https://discuss.elastic.co/t/remove-charactes-with-gstug/184771>\
**Category:** Logstash\
**Created:** [June 7, 2019, 1:59pm UTC](https://discuss.elastic.co/t/remove-charactes-with-gstug/184771 "2019-06-07T13:59:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AntonioSanz](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@AntonioSanz](https://discuss.elastic.co/u/AntonioSanz)\
**Post date:** [June 7, 2019, 1:59pm UTC](https://discuss.elastic.co/t/remove-charactes-with-gstug/184771/1 "2019-06-07T13:59:18Z")

</div>

Hi all, I would need some help with mutate gsub filter.

I have something like

ArchivedCanonicalItemEvent CanonicalProductSalesAreaToCatalogMapping SAPCONFIGURATION\_POOL 26472b62-8943-44a4-a88e-6dabee93d825 20\_1001 098996f0-367b-3c75-afbb-f40653b744f12 79 1001\_20B\bARCHIVED

CanonicalItemEvent CanonicalProductSalesAreaToCatalogMapping SAPCONFIGURATION\_POOL c1036fbd-8a49-45f5-8787-5c2f9d389e71 20\_1002 f15cc8bb-f1b0-37a1-834e-b1f26c0543db2 80 1002\_20B\aSUCCESS

I need some help using a mutate filter to replace

B\bARCHIVED --\> ARCHIVED  
B\aSUCCESS --\> SUCCESS

I've tried with

mutate {  
gsub =\> ["message", "B\bARCHIVED", "ARCHIVED"]  
}

```
		mutate {
	gsub => ["message", "B\aSUCCESS", "SUCCESS"]
}

```

But I get same result.

Any help?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2019, 1:59pm UTC](https://discuss.elastic.co/t/remove-charactes-with-gstug/184771/2 "2019-07-05T13:59:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.