# Remove / using logstash filter
**URL:** https://discuss.elastic.co/t/remove-using-logstash-filter/316106
**Category:** Logstash
**Created:** [October 7, 2022, 7:17pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106 "2022-10-07T19:17:51Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [October 7, 2022, 7:17pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106/1 "2022-10-07T19:17:52Z")
I used multiple mutate filters to remove the / in the message field, which is not working. Also, I want to parse these message fields into valid JSON.
Please suggest and help.
{
"host" =\> "[mylocalhost.mydomain.com](http://mylocalhost.mydomain.com)",
"@version" =\> "1",
"message" =\> "2022-10-07T16:58:22.209Z 10.30.94.20 {"ap\_count": 0, "cpu\_utilization": 0, "firmware\_backup\_version": "8.7.0.0-2.3.0.4\_82267", "firmware\_version": "8.7.0.0-2.3.0.4\_82267", "group\_name": "my-group", "ip\_address": "10.10.10.10", "is\_firmware\_version\_supported": true, "labels": ["Corp", "LAB"], "labels\_info": [{"id": 888, "name": "Corp"}, {"id": 777, "name": "LAB"}], "location": {"gps": {"latitude": "99.9215415", "longitude": "-00.935501"}, "override": false, "serial\_number": "", "street\_address": {"address\_1": "6 city", "city": "lux", "country": "UK", "postal\_code": "08054", "state": "New Jersey"}}, "mac\_range": "20:4c:03:04:af:40 - 20:4c:03:04:af:5f", "macaddr": "20:4c:03:04:af:40", "mem\_free": 0, "mem\_total": 0, "mm\_hostname": null, "mobility\_master": null, "mode": "GATEWAY", "model": "A555", "devi\_info": null, "name": "L-8x", "ntp\_server\_info": {"server": "host01-mydomain.net", "sync": 1}, "peers": , "poe\_available": "-", "poe\_budget": "-", "poe\_consumption": "-", "poe\_supported": true, "public\_ip": "77.77.55.91", "reason": "I took", "recommended\_version": "8.7.0.0-2.3.0.7\_83952", "redundancy\_peer\_hostname": null, "redundancy\_peer\_sn": null, "role": "", "serial": "5555", "site": "5555", "site\_info": {"id": 890, "name": "555"}, "status": "Down", "uplinks": [{"default\_gw": "192.168.1.1", "description": "-0/0/15", "is\_backup": true, "is\_virtual\_uplink": false, "link\_index": 101, "link\_status": "Down", "link\_tag": "inet", "name": "uplink101", "priority": 200, "private\_ip": "192.168.1.0", "public\_ip": "77.55.77.98", "status": "Down", "vlllanan": 4094, "vlakaanfd\_description": "inet", "LAN\_status": "Down", "Bus\_type": "Internet"}, {"default\_gw": "0.0.0.0", "description": "metro-channel/0/14", "is\_backup": false, "is\_virtual\_uplink": false, "link\_index": 102, "link\_status": "Down", "link\_tag": "ethernet", "name": "uplink102", "priority": 200, "private\_ip": "0.0.0.0", "public\_ip": "0.0.0.0", "status": "Down", "vlan": 4093, "vlan\_description": "ethernet", "wan\_status": "Down", "wan\_type": "Metro-E"}], "uptime": 0, "usage": 0}",
"@timestamp" =\> 2022-10-07T19:03:01.786Z,
"path" =\> "/tmp/sample/58.pat3.txt"
}
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 7, 2022, 7:30pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106/2 "2022-10-07T19:30:50Z")
How do you try to remove and which field?
According to this sample, the message field hasn't been parsed at all.
You can use grok to parse:
`%{TIMESTAMP_ISO8601:time}\s*%{IP:ip}\s*%{GREEDYDATA:jsonmsg}`
Then extract fields from jsonmsg. After that you can remove field(s).
---
### Author:  [@Giridharan\_C](https://discuss.elastic.co/u/Giridharan_C)
#### Post date: [October 8, 2022, 4:51am UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106/3 "2022-10-08T04:51:19Z")
@Rios - I have tried the above and still the \ is there. Please find the conf and output below.
```auto
input {
file {
path => "/tmp/sample/*.txt"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time}\s*%{IP:ip}\s*%{GREEDYDATA:jsonmsg}" }
}
mutate { remove_field => ["message"] }
}
output {
stdout {}
file {
#codec => json
path => "/tmp/output/output.txt"
}
}
```
output:
{
"@version" =\> "1",
"ip" =\> "10.10.10.11",
"path" =\> "/tmp/sample/part3.txt",
"@timestamp" =\> 2022-10-08T04:39:31.702Z,
"time" =\> "2022-10-07T16:58:22.230Z",
"jsonmsg" =\> "{"ap\_count": 0, "cpu\_utilization": 11, "firmware\_backup\_version": "82660", "firmware\_version": "82660", "group\_name": "7010", "ip\_address": "10.10.10.11", "is\_firmware\_version\_supported": true, "labels": ["West", "West"], "labels\_info": [{"id": 1021, "name": "West"}, {"id": 10237878, "name": "West"}], "location": {"gps": {"latitude": "100.5989497", "longitude": "-100.4229842"}, "override": false, "serial\_number": "", "street\_address": {"address\_1": "1755 Way", "city": "gold", "country": "moracco", "postal\_code": "55555", "state": "goa"}}, "mac\_range": ":9c - 20:4c:03:", "macaddr": "20:4c", "mem\_free": 1678475264, "mem\_total": 3142696960, "mm\_hostname": null, "mobility\_master": null, "mode": "GATEWAY", "model": "A7012310", "modem\_info": null, "name": "mydevice.myhost.net", "ntp\_server\_info": {"server": "abce.myhost-super.mydomain.net", "sync": 1}, "peers": , "poe\_available": 119.9, "poe\_budget": 150.0, "poe\_consumption": 30.1, "poe\_supported": true, "public\_ip": "75.75.75.99", "reason": "heat temp", "recommended\_version": "83952", "redundancy\_peer\_hostname": null, "redundancy\_peer\_sn": null, "role": "", "serial": "abc671283", "site": "super\_market", "site\_info": {"id": 11, "name": "supermarket"}, "status": "Up", "uplinks": [{"default\_gw": "192.0.0.1", "description": "inet-0/0/15", "is\_backup": true, "is\_virtual\_uplink": false, "link\_index": 101, "link\_status": "Down", "link\_tag": "inet", "name": "uplink101", "priority": 200, "private\_ip": "0.0.0.0", "public\_ip": "0.0.0.0", "status": "Down", "vlan": 4094, "vlan\_description": "inet", "wan\_status": "Down", "wan\_type": "Internet"}, {"default\_gw": "75.75.75.1", "description": "metro-ethernet-0/0/14", "is\_backup": false, "is\_virtual\_uplink": false, "link\_index": 102, "link\_status": "Up", "link\_tag": "metro-ethernet", "name": "uplink102", "priority": 200, "private\_ip": "71.71.71.17", "public\_ip": "71.71.71.17", "status": "Up", "vlan": 4093, "vlan\_description": "metro-ethernet", "wan\_status": "Up", "wan\_type": "Metro-E"}], "uptime": 559149, "usage": 0}",
"host" =\> [myhost.mydomain.com](http://myhost.mydomain.com)"
}
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 8, 2022, 1:52pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106/4 "2022-10-08T13:52:32Z")
```auto
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time}\s*%{IP:ip}\s*%{GREEDYDATA:jsonmsg}" }
}
date {
match => ["time", "ISO8601"]
remove_field => ["time", "log", "host", "event"]
}
# remove /
mutate {
gsub => ["jsonmsg","[\/]", ""]
}
# replace missing values with null
mutate {
gsub => ["jsonmsg",'\": ,', '": null,']
}
json {
source => "jsonmsg"
}
}
```
`"description" => "metro-channel014"` \<- removed "/"
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 5, 2022, 1:53pm UTC](https://discuss.elastic.co/t/remove-using-logstash-filter/316106/5 "2022-11-05T13:53:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.