# Replace return carriage associated with tab
**URL:** https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554
**Category:** Logstash
**Created:** [May 15, 2024, 1:58pm UTC](https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554 "2024-05-15T13:58:59Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)
#### Post date: [May 15, 2024, 1:58pm UTC](https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554/1 "2024-05-15T13:58:59Z")
Hello,
I'm monitoring Windows File integrity and I want to replace some return carriage and tab that are present in the value of the field.
- Field:
`winlog.event_data.AccessList `
- Value:
```auto
%%1537
%%1538
%%1541
%%4423
```
- Target value:
```auto
%%1537 - %%1538 - %%1541 - %%4423
```
- My filter:
```auto
filter {
if [winlog][event_data][AccessList] {
mutate { gsub => ["winlog.event_data.AccessList", "\\n\\t\\t\\t\\t", " - "] }
mutate { gsub => ["winlog.event_data.AccessList", "[\n\t\t\t\t]", " - " ] }
mutate { gsub => ["winlog.event_data.AccessList", "\n\t\t\t\t", " - "] }
mutate { gsub => [ "winlog.event_data.AccessList", "
", " - " ] }
}
}
```
I've tried the 4 mutate lines with gsub but none of them works.
**Additionnal info**
I'm currently moving from previous Log solution (graylog) and this was how I did:
```auto
rule "Winlogbeat - File Monitoring - replace tab and carriage return by simple space"
when
has_field("winlog_event_data_AccessList")
then
let repl_carr = regex_replace("
", to_string($message."winlog_event_data_AccessList")," - ",true);
set_field ("winlog_event_data_AccessList", repl_carr);
end
```
Thank you for the help !
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 15, 2024, 2:08pm UTC](https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554/2 "2024-05-15T14:08:12Z")
You could try
```
mutate { gsub => ["message", "\n\t+%", " - %"] }
```
---
### Author:  [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)
#### Post date: [May 15, 2024, 2:17pm UTC](https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554/4 "2024-05-15T14:17:31Z")
It seem it does not work, is it because of the double %% ?
**json format:**
```auto
"AccessList": "%%1537\n\t\t\t\t%%1538\n\t\t\t\t%%1539\n\t\t\t\t%%1541\n\t\t\t\t%%4416\n\t\t\t\t%%4417\n\t\t\t\t%%4418\n\t\t\t\t%%4419\n\t\t\t\t%%4420\n\t\t\t\t%%4423\n\t\t\t\t%%4424\n\t\t\t\t",
```
`message` field does not contain the %%xxxx values, it contains the Human Readable values
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 15, 2024, 2:40pm UTC](https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554/5 "2024-05-15T14:40:53Z")
No, the single % is just used to anchor the whitespace to the value. You need to replace [message] with the actual field name, like [winlog][event\_data][AccessList]
---
### Author:  [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)
#### Post date: [May 15, 2024, 2:55pm UTC](https://discuss.elastic.co/t/replace-return-carriage-associated-with-tab/359554/6 "2024-05-15T14:55:40Z")
I've followed the doc too blindfoldly ^^, juste because there was no brackets in the example, I said to myself there no need to add it... silly me.
Thanks for the tips with the single %. I'm still learning as its a bit different than Graylog process language (which use java)
My final filter is:
```auto
filter {
if [winlog][event_data][AccessList] {
mutate { gsub => ["[winlog][event_data][AccessList]", "\n\t+%", " - %" ] }
}
}
```