# Removing substring from key and result

**URL:** <https://discuss.elastic.co/t/removing-substring-from-key-and-result/191730>\
**Category:** Logstash\
**Created:** [July 23, 2019, 4:24am UTC](https://discuss.elastic.co/t/removing-substring-from-key-and-result/191730 "2019-07-23T04:24:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shagun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shagun/32/59565_2.png) [@shagun](https://discuss.elastic.co/u/shagun)\
**Post date:** [July 23, 2019, 4:24am UTC](https://discuss.elastic.co/t/removing-substring-from-key-and-result/191730/1 "2019-07-23T04:24:55Z")

</div>

```
    { 

    "x'property'" : "x'true'",
    "x'type'" : "x'user'"

    } 

```

I need to parse it and want to remove the **x'** and **single quotes** from both key and value pair

like:

```
 { 

        "property" : "true",
        "type" : "user"

        } 

```

I have tried gsub and mutate, but unable to find solution

I have **n** number of fields like this.

---

<div class="post-metadata">

**Author:** ![sjabiulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sjabiulla/32/48429_2.png) [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\
**Post date:** [July 23, 2019, 7:13am UTC](https://discuss.elastic.co/t/removing-substring-from-key-and-result/191730/2 "2019-07-23T07:13:37Z")

</div>

I have tried with below and was able to replace and parse properly. Please check the below config.

```
input {
    stdin {}
}

filter {
    mutate { 
    	gsub => ["message", "x'", ""] 
    	gsub => ["message", "'", ""]
    }
    json { 
        source => "message"
    }
}

output {
    stdout {}
}

```

Input I used :

`{"x'property'" : "x'true'","x'type'" : "x'user'"}`

Output I got with the above config :

```
{
       "message" => "{\"property\" : \"true\",\"type\" : \"user\"}\r",
    "@timestamp" => 2019-07-23T06:36:33.736Z,
          "type" => "user",
      "@version" => "1",
      "property" => "true"
}

```

Hope this helps.

Instead of using gsub twice, I think we can use regex as well. But I'm not familiar with regex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2019, 7:14am UTC](https://discuss.elastic.co/t/removing-substring-from-key-and-result/191730/3 "2019-08-20T07:14:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.