Remove garbage from message end

[John_Smith]

Hello,

I've following message send by filebeat:
"message" => "{"country-code":"GB","payload":"{\"access_token\":\"**********\",\"token_type\":\"Bearer\",}","status":"ok","status-code":200,"error":"","content-type":"application/x-www-form-urlencoded","inbound-request-uri":"","outbound-url":"","message-size":106,"msisdn":"","env-name":"staging","headers":{"Connection":"keep-alive","Content-Type":"application/json"},"service-flow":"PreFlow","verb":"POST"}\u0000"

For some reason filebeat put this \u0000 at the end of the message - why i think it's filebeat - because for now we're using rsyslog and this is not there . I'm trying to switch to filebeat.

So this (\u0000) breaking next filter
json {
source message
}

Can someone advice how to remove this garbage ?
Thanks in advance.

[Badger]

Try

mutate { gsub => [ "message", "\u0000", "" ] }

If that does not work then send the event to

output { stdout { codec => rubydebug } }

and show us what that \u0000 looks like.

[John_Smith]

Thanks Badger,

It's working, but is there any solution to check if it's exactly at the end of the message field - don't want to drop something inside ?

Thanks again.

[Badger]

You can anchor it using $ so that it only matches at the end of the string...

mutate { gsub => [ "message", "\u0000$", "" ] }`