# Remove HTTP encondings
**URL:** https://discuss.elastic.co/t/remove-http-encondings/345720
**Category:** Logstash
**Created:** [October 25, 2023, 11:12am UTC](https://discuss.elastic.co/t/remove-http-encondings/345720 "2023-10-25T11:12:09Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@lemospt](https://discuss.elastic.co/u/lemospt)
#### Post date: [October 25, 2023, 11:12am UTC](https://discuss.elastic.co/t/remove-http-encondings/345720/1 "2023-10-25T11:12:09Z")
Hi guys,
i'm integrating log from proxy squid, there is a field called 'Original Received Request Header' that has data like below,
User-Agent:%20git/2.30.2%0D%0AProxy-Connection:%20Keep-Alive%0D%0AHost:%[20github.private.com:443](http://20github.private.com:443/)%0D%0A
So basically i want to remove http encodings and get the following,
User-Agent:git/2.30.2
Proxy-Connection:Keep-Alive
Host:github.private.com:443
Thanks in advance.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 25, 2023, 12:38pm UTC](https://discuss.elastic.co/t/remove-http-encondings/345720/2 "2023-10-25T12:38:24Z")
```auto
filter {
mutate{ gsub => ["message", "%0D|%0A|%20", ""] }
grok { match => { "message" => "User-Agent:%{DATA:User-Agent}Proxy-Connection:%{DATA:Proxy-Connection}Host:%{GREEDYDATA:Host}" } }
}
```
```auto
{
"User-Agent" => "git/2.30.2",
"Host" => "github.private.com:443",
"message" => "User-Agent:git/2.30.2Proxy-Connection:Keep-AliveHost:github.private.com:443",
"Proxy-Connection" => "Keep-Alive"
}
```
---
### Author:  [@lemospt](https://discuss.elastic.co/u/lemospt)
#### Post date: [October 25, 2023, 4:17pm UTC](https://discuss.elastic.co/t/remove-http-encondings/345720/3 "2023-10-25T16:17:43Z")
thanks @Rios, it's not the solution i use but you point me to the answer.
Let here what i implement,
mutate{ gsub =\> ["requestheader", "%20", ""] }
mutate{ gsub =\> ["requestheader", "%0D|%0A", " "] }
kv {
source =\> "requestheader"
value\_split =\> ":"
}
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 25, 2023, 5:03pm UTC](https://discuss.elastic.co/t/remove-http-encondings/345720/4 "2023-10-25T17:03:12Z")
Yes, you can use KV filer. For gsub just need to be tested, which is better for your case.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2023, 5:03pm UTC](https://discuss.elastic.co/t/remove-http-encondings/345720/5 "2023-11-22T17:03:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.