# Removing ansi color codes with mutate

**URL:** <https://discuss.elastic.co/t/removing-ansi-color-codes-with-mutate/41958>\
**Category:** Logstash\
**Created:** [February 17, 2016, 2:13am UTC](https://discuss.elastic.co/t/removing-ansi-color-codes-with-mutate/41958 "2016-02-17T02:13:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![encee](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@encee](https://discuss.elastic.co/u/encee)\
**Post date:** [February 17, 2016, 2:13am UTC](https://discuss.elastic.co/t/removing-ansi-color-codes-with-mutate/41958/1 "2016-02-17T02:13:32Z")

</div>

Hello,

I have been trying to strip the color codes out of my logs so that I can more easily use logstash but I have been unable to actually get it to work.

I found a comment and a small article that had a mutate string listed (works with sed just fine) but I cannot get it to work, has anyone been able to get that working?

Here is a little copy paste of the issue

filter {  
if [type] == "testlog" {  
mutate {  
gsub =\> ["message", "\r", ""]  
}  
mutate {  
gsub =\> ["message", "\x1B[([0-9]{1,3}((;[0-9]{1,3})\*)?)?[m|K]", "" ]  
}  
grok {  
match =\> [  
"message", "(?m)%{GREEDYDATA:rawdata}"  
]  
}  
date {  
match =\> ["timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"]  
timezone =\> 'UTC'  
}  
}  
}  
output { stdout { codec =\> rubydebug } }

input - ^[[0;37m2016-02-16 07:05:03.435^[[0m [^[[0;37mDEBUG^[[0m]

output - "rawdata" =\> "^[[0;37m2016-02-16 07:04:29.208^[[0m [^[[32mINFO ^[[0m]

( I realize the lines are different but are just there as examples )

---

<div class="post-metadata">

**Author:** ![crenkore](https://avatars.discourse-cdn.com/v4/letter/c/59ef9b/32.png) [@crenkore](https://discuss.elastic.co/u/crenkore)\
**Post date:** [July 12, 2016, 8:10am UTC](https://discuss.elastic.co/t/removing-ansi-color-codes-with-mutate/41958/2 "2016-07-12T08:10:07Z")

</div>

me too... still not working after add mutate..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/removing-ansi-color-codes-with-mutate/41958/3 "2017-07-06T04:48:29Z")

</div>