Removing of \\\\ via filebeat while parsing logs to elastic search

  1. log line:
    {"log":"{\"time\":\"2019-11-04 18:06:07.+00:00\",\"severity\":\"Information\",\"name\":\"\"45632dc\"\",\"class\":\"\"Middleware\"\",\"mcr\":\"\"__3\"\",\"msg\":\"###Request: http url ###Response: 200: {\\n [\\\"state\\\](file:///%22state/)": [\\\"good\\\",\\n](file:///%22good/%22,/n) [\\\"results\\\](file:///%22results/)": {\\n [\\\"Check\\\](file:///%22Check/)": {\\n [\\\"status\\\](file:///%22status/)": [\\\"Healthy\\\",\\n](file:///%22Healthy/%22,/n) [\\\"description\\\](file:///%22description/)": [\\\"A](file:///%22A) healthy result\\\",\\n [\\\"data\\\](file:///%22data/)": {\\n [\\\"id\\\](file:///%22id/)": [\\\"daf6\\\",\\n](file:///%daf6/%22,/n) [\\\"version\\\](file:///%22version/)": 1,\\n [\\\"config_rev\\\](file:///%22config_rev/)": 108,\\n [\\\"sdk\\\](file:///%22sdk/)": [\\\"sdk/2.7.16.0](file:///%22sdk/2.7.16.0) (clr/.NET Core 3.1.8) (os/Linux #1 SMP Thu Sep 3 19:04:44 UTC 2020)[\\\",\\n](file:///%22,/n) [\\\"services\\\](file:///%22services/)": {\\n [\\\"kv\\\](file:///%22kv/)": [\\n {\\n [\\\"id\\\](file:///%22id/)": [\\\"b854\\\",\\n](file:///%df6a5b854/%22,/n) [\\\"state\\\](file:///%22state/)": [\\\"ok\\\",\\n](file:///%22ok/%22,/n) [\\\"local\\\](file:///%22local/)": [\\\"ip\\\",\\n](file:///%22ip/%22,/n) [\\\"remote\\\](file:///%22remote/)": [\\\"ip\\\",\\n](file:///%22ip/%22,/n) [\\\"last_activity\\\](file:///%22last_activity/)": 949218,\\n [\\\"latency_us\\\](file:///%22latency_us/)": 1497068,\\n [\\\"scope\\\](file:///%22scope/)": [\\\"Qa\\\"\\n](file:///%Qa/%22/n) },\\n {\\n [\\\"id\\\](file:///%22id/)": [\\\"c9\\\",\\n](file:///%22c9,/n) [\\\"state\\\](file:///%22state/)": [\\\"ok\\\",\\n](file:///%22ok/%22,/n) [\\\"local\\\](file:///%22local/)": [\\\"ip\\\",\\n](file:///%22ip/%22,/n) [\\\"remote\\\](file:///%22remote/)": [\\\"ip\\\",\\n](file:///%22ip/%22,/n) [\\\"last_activity\\\](file:///%22last_activity/)": 940352,\\n

Any toughts to remove "\" and \n in log while parsing to elastic search via file beat s.`

`

You can think about the script processor, which allows for applying Javascript transformations.

It works

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.