# Remove escape characters from Drive

**URL:** <https://discuss.elastic.co/t/remove-escape-characters-from-drive/365378>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [August 22, 2024, 11:39am UTC](https://discuss.elastic.co/t/remove-escape-characters-from-drive/365378 "2024-08-22T11:39:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\
**Post date:** [August 22, 2024, 11:39am UTC](https://discuss.elastic.co/t/remove-escape-characters-from-drive/365378/1 "2024-08-22T11:39:43Z")

</div>

Hi, I'm monitoring some windows machines with metricbeat, the drives always have escape characters \ that handling in logstash, and in kibana rules is a nightmare, is there a good way to remove them? preferably directly in metricbeat

---

<div class="post-metadata">

**Author:** ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\
**Post date:** [August 22, 2024, 12:55pm UTC](https://discuss.elastic.co/t/remove-escape-characters-from-drive/365378/2 "2024-08-22T12:55:52Z")

</div>

I found a way:

```auto
processors:
  - replace:
      fields:
        - field: "system.filesystem.mount_point"
          pattern: "\\\\"
          replacement: ""
      ignore_missing: false
      fail_on_error: true

```

one single \ needs to be espaced three times!