# Replace double backslashes // with one / in a string

**URL:** <https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858>\
**Category:** Logstash\
**Created:** [January 26, 2019, 5:59pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858 "2019-01-26T17:59:55Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![x4cker](https://avatars.discourse-cdn.com/v4/letter/x/f08c70/32.png) [@x4cker](https://discuss.elastic.co/u/x4cker)\
**Post date:** [January 26, 2019, 5:59pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/1 "2019-01-26T17:59:55Z")

</div>

Hi,  
how can I replace the double backslashes with only one?  
input: `domain\\user`  
expected output: `domain\user`

i have tried several methods without success. I could only remove it in this way, but it's not what's needed:

```
  mutate {
	gsub => ["message", "[\\]", ""]
  }

```

sample line of input:

`"message":"1,2019/01/25 23:59:59,0011C104451,TRAFFIC,end,2049,2019/01/25 23:59:59,10.20.30.40,10.20.255.23,0.0.0.0,0.0.0.0,Allow MXX-MYY,domain.net\user,,ldap,vsys4,GMPLS Internal,GMPLS External,ethernet1/12,ethernet1/15,Logging_Shared,2019/01/25 23:59:59,73227,1,54036,389,0,0,0x1b,tcp,allow,"`

thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 26, 2019, 7:29pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/2 "2019-01-26T19:29:23Z")

</div>

> [@x4cker](#):
>
> I could only remove it in this way, but it's not what's needed:
> 
> ```auto
> mutate {
> gsub => ["message", "[\\]", ""]
> }
> 
> ```

That's the standard way to do it. Why is it not what's needed? Another approach is to use [config.support\_escapes](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html) .

---

<div class="post-metadata">

**Author:** ![x4cker](https://avatars.discourse-cdn.com/v4/letter/x/f08c70/32.png) [@x4cker](https://discuss.elastic.co/u/x4cker)\
**Post date:** [January 26, 2019, 8:09pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/3 "2019-01-26T20:09:05Z")

</div>

Hi Badger,  
Thank you. I would like to replace the double backslashes with one backslash. Not to remove them  
Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 26, 2019, 9:36pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/4 "2019-01-26T21:36:28Z")

</div>

Oh, OK, I didn't get that. You could change double backslash to single using a similar regexp that matches two backslashes with a capture group to keep the second one...

```
gsub => ["message", "[\\]([\\])", "\1" ]
```

---

<div class="post-metadata">

**Author:** ![x4cker](https://avatars.discourse-cdn.com/v4/letter/x/f08c70/32.png) [@x4cker](https://discuss.elastic.co/u/x4cker)\
**Post date:** [January 28, 2019, 4:00pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/5 "2019-01-28T16:00:05Z")

</div>

thank you so much, that solved it

how would it be possible to replace the `\"` with `"` ?  
i could only remove them this way

`gsub => ["message", "[\\\"]", ""]`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 28, 2019, 4:06pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/6 "2019-01-28T16:06:01Z")

</div>

```
gsub => ["message", '[\\]"', '"' ]

```

should work

---

<div class="post-metadata">

**Author:** ![x4cker](https://avatars.discourse-cdn.com/v4/letter/x/f08c70/32.png) [@x4cker](https://discuss.elastic.co/u/x4cker)\
**Post date:** [January 28, 2019, 4:38pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/7 "2019-01-28T16:38:57Z")

</div>

> [@Badger](#):
>
> gsub =\> ["message", '[\]"', '"' ]

thanks alot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2019, 4:39pm UTC](https://discuss.elastic.co/t/replace-double-backslashes-with-one-in-a-string/165858/8 "2019-02-25T16:39:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.