# Removing annoying characters before a Json formated string

**URL:** https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522
**Category:** Logstash
**Created:** [November 20, 2018, 11:17am UTC](https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522 "2018-11-20T11:17:39Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Josef](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@Josef](https://discuss.elastic.co/u/Josef)
#### Post date: [November 20, 2018, 11:17am UTC](https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522/1 "2018-11-20T11:17:39Z")

</div>

Hello,

I'm just a beginner in ELK, so please forgive me in advance.

Here is the kind of input I have in logstash :  
E...(.@.@..b......................=...B.{"rxpk":[{"tmst":297436019,"time":"2018-11-20T10:54:01.237397Z","chan":1,"rfch":1,"freq":868.300000,"stat":1,"modu":"LORA","datr":"SF7BW125","codr":"4/5","lsnr":6.0,"rssi":-103,"size":32,"data":"QAUbASaAYAEBa0v5zRPad7A8WAjW8JnOLkg3ttCEoPU="}]}

And I would like to remove the first part before the Json, i.e "E...(.@.@..b......................=...B."  
I specify that this part is kind of random, more or less characters etc.  
The only pattern is that it begins with E and ends with B.

Thank you in advance for your help

JoJo

---

<div class="post-metadata">

### Author: ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)
#### Post date: [November 20, 2018, 1:45pm UTC](https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522/2 "2018-11-20T13:45:31Z")

</div>

You could try using the gsub filter like this:

```
mutate {    
    gsub => [ 
		"message", "E*B", ""
    ]
}

```

Where "message" is the field name and "E\*B" is the pattern to search for.

But ideally if possible it would be nicer to sort the input.

I haven't tried this but it should hopefully work!

---

<div class="post-metadata">

### Author: ![Josef](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@Josef](https://discuss.elastic.co/u/Josef)
#### Post date: [November 21, 2018, 9:06am UTC](https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522/3 "2018-11-21T09:06:21Z")

</div>

Thank you for your reply.  
Thanks to your answer, I managed to separate the two parts instead of removing one  
Here is my code if it can help some people in the same case

Actually, the _grok_ filter uses the braces as a separator and with _mutate_ we're adding new ones at each side of the json

[...]  
filter {  
grok {  
match =\> {"message" =\> "%{DATA:bullshit}{%{DATA:data}}" }  
}  
mutate {  
add\_field =\> {  
"true" =\> "{%{data}}"  
}  
}  
json {  
source =\> "%{true}"  
target =\> "rxpk"  
}  
}  
[...]

Again, thanks for all 🙂

---

<div class="post-metadata">

### Author: ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)
#### Post date: [November 21, 2018, 9:24am UTC](https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522/4 "2018-11-21T09:24:57Z")

</div>

Glad you got it sorted!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 19, 2018, 9:25am UTC](https://discuss.elastic.co/t/removing-annoying-characters-before-a-json-formated-string/157522/5 "2018-12-19T09:25:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.