# Removing \\ from raw input log data
**URL:** https://discuss.elastic.co/t/removing-from-raw-input-log-data/329062
**Category:** Logstash
**Created:** [March 31, 2023, 2:44pm UTC](https://discuss.elastic.co/t/removing-from-raw-input-log-data/329062 "2023-03-31T14:44:19Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Merdesz](https://discuss.elastic.co/u/Merdesz)
#### Post date: [March 31, 2023, 2:44pm UTC](https://discuss.elastic.co/t/removing-from-raw-input-log-data/329062/1 "2023-03-31T14:44:19Z")
I have a device sending in logs which have "" before every string caracter and I would like to remove them or rewrite them to a simple ". So this " --\> " to this.
Logs:
srcintfrole="undefined" dstip=255.255.255.255 dstport=000 dstintf="interface" dstintfrole="interface" srccountry="Reserved" dstcountry="counrtyname" sessionid=2458616 proto=6 action="timeout" policyid=0 service="HTTPS"
I have tried with a logstash filter but it does not seem to work.
```auto
input {
tcp {
port => port_number
}
}
filter{
mutate {
gsub => ["message", "\"", '"']
}
}
output {
elasticsearch {
hosts => ["host_name"]
index => "index_name"
cacert => "cert_path"
pipeline => "pipeline_name"
user => "user_name"
password => "password"
}
}
```
The logs arrive into elasticsearch but without required modifications.
Any help or advice is greatly appreciated.
Márton
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 31, 2023, 6:53pm UTC](https://discuss.elastic.co/t/removing-from-raw-input-log-data/329062/2 "2023-03-31T18:53:11Z")
> [@Merdesz](#):
>
> ```
> mutate { gsub => ["message", "\"", '"'] }
>
> ```
That is a no-op. It replaces a double quote with a double quote. If you want to replace an escaped double quote with a double quote then try
```
mutate { gsub => ["message", '\\"', '"'] }
```
Otherwise edit your post with appropriate markdown to make it clear what you want.
---
### Author:  [@Merdesz](https://discuss.elastic.co/u/Merdesz)
#### Post date: [April 3, 2023, 8:17am UTC](https://discuss.elastic.co/t/removing-from-raw-input-log-data/329062/3 "2023-04-03T08:17:59Z")
Thank you, this was all I needed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2023, 8:18am UTC](https://discuss.elastic.co/t/removing-from-raw-input-log-data/329062/4 "2023-05-01T08:18:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.