# Remove left whitespaces logstash
**URL:** https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514
**Category:** Logstash
**Created:** [May 12, 2022, 1:35am UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514 "2022-05-12T01:35:31Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [May 12, 2022, 1:35am UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/1 "2022-05-12T01:35:31Z")
Hi i have the following fields:
"delivery\_quantity" : " \s\s\s\s4",
"numerator" : "\s\s\s1",
"denominator" : "\s\s\s1"
I've tried to use mutate split and gsub but didnt work.
I've seen that split works when you have for example:
"delivery\_quantity" : "4 "
i,e, whitespaces from the right.
Any help please?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 12, 2022, 2:01am UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/2 "2022-05-12T02:01:10Z")
> [@dannie-ml](#):
>
> I've tried to use mutate split and gsub but didnt work
Both should work. Using
```
input { generator { count => 1 lines => ['{ "a": " 1" }'] codec => json } }
```
you could use either
```
mutate { gsub => ["[a]", "\s+(\S)", "\1" ] }
```
or
```
mutate { split => { "a" => " " } }
mutate { replace => { "a" => "%{[a][0]}" } }
```
If you do not know which fields you need to adjust ahead of time then use ruby
```
ruby {
code => '
event.to_hash.each { |k, v|
if v =~ /^\s/
event.set(k, v.sub(/^\s+/, ""))
end
}
'
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [May 12, 2022, 3:28am UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/3 "2022-05-12T03:28:53Z")
The `mutate` fiter has a setting called [strip](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-strip) to remove leading and trailing spaces.
Just try to add this in your pipeline.
```auto
mutate {
strip => ["numerator", "delivery_quantity"]
}
```
---
### Author:  [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [May 12, 2022, 5:50am UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/4 "2022-05-12T05:50:26Z")
I tried but I'm suppossing that this filter don't work with left whitespaces.
I've had a fields that had right whitespaces like:
example: "string\s\s\s\s" and the strip work just fine but in this case that I have
example: "\s\s\s\s string" don't work as expected.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [May 12, 2022, 12:19pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/5 "2022-05-12T12:19:14Z")
It should work for both leading (on the left) and trailing (on the right) spaces.
Unless those are not spaces but other character like tabs, I'm not sure the filter works with tabs.
You could try to use a gsub to remove the tab character, just use `\t`.
I think it would be something like this:
```auto
mutate {
gsub => ["fieldName", "\t", ""]
}
```
---
### Author:  [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [May 12, 2022, 3:31pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/6 "2022-05-12T15:31:40Z")
The only thing that worked was the Ruby Code, thank you so much.
---
### Author:  [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [May 12, 2022, 3:35pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/7 "2022-05-12T15:35:38Z")
Do you know how to handle an expression,for example i have a field:
path: /string/string/string/string/file.txt
and i want to get only the last part, i.e, the file.txt.
the filter strip can help me?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 12, 2022, 4:01pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/8 "2022-05-12T16:01:15Z")
See [this](https://discuss.elastic.co/t/logtash-adding-filename-as-index-name/131487/2) thread.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2022, 4:01pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514/9 "2022-06-09T16:01:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.