Replace double backslashes // with one / in a string

Elastic Stack Logstash
1

Hi,
how can I replace the double backslashes with only one?
input: domain\\user
expected output: domain\user

i have tried several methods without success. I could only remove it in this way, but it's not what's needed:

  mutate {
	gsub => ["message", "[\\]", ""]
  }

sample line of input:

"message":"1,2019/01/25 23:59:59,0011C104451,TRAFFIC,end,2049,2019/01/25 23:59:59,10.20.30.40,10.20.255.23,0.0.0.0,0.0.0.0,Allow MXX-MYY,domain.net\user,,ldap,vsys4,GMPLS Internal,GMPLS External,ethernet1/12,ethernet1/15,Logging_Shared,2019/01/25 23:59:59,73227,1,54036,389,0,0,0x1b,tcp,allow,"

thank you

2

That's the standard way to do it. Why is it not what's needed? Another approach is to use config.support_escapes .

3

Hi Badger,
Thank you. I would like to replace the double backslashes with one backslash. Not to remove them
Regards

4

Oh, OK, I didn't get that. You could change double backslash to single using a similar regexp that matches two backslashes with a capture group to keep the second one...

gsub => [ "message", "[\\]([\\])", "\1" ]
1 Like
5

thank you so much, that solved it

how would it be possible to replace the \" with " ?
i could only remove them this way

gsub => ["message", "[\\\"]", ""]

6 
gsub => [ "message", '[\\]"', '"' ]

should work

7

thanks alot

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.