# Small help with gsub

**URL:** <https://discuss.elastic.co/t/small-help-with-gsub/29693>\
**Category:** Logstash\
**Created:** [September 21, 2015, 10:17am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693 "2015-09-21T10:17:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [September 21, 2015, 10:17am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693/1 "2015-09-21T10:17:15Z")

</div>

**I have this string: (dont ask 🙂 )**

"{"InternalMessageQueueSize":5,"ExceptionsNumber":300}"

**i like to change it with gsub to this:**

{"InternalMessageQueueSize":5,"ExceptionsNumber":300}

can you help with the sytax?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 21, 2015, 10:42am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693/2 "2015-09-21T10:42:37Z")

</div>

Well, what you _really_ want is this:

{"InternalMessageQueueSize":5,"ExceptionsNumber":300}

---

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [September 21, 2015, 10:47am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693/3 "2015-09-21T10:47:16Z")

</div>

**Basically the message is :**  
"{"InternalMessageQueueSize":5,"ExceptionsNumber":300}"

**Logstash add escape character to the message:**  
""{\"InternalMessageQueueSize\":5,\"ExceptionsNumber\":300}""

**i am using gsub like this to remove \:**  
**gsub =\> ["message", "[\]", ""]**  
""{"InternalMessageQueueSize":5,"ExceptionsNumber":300}""

**now i need to remove the start " and the last one to be like this**  
"{"InternalMessageQueueSize":5,"ExceptionsNumber":300}"

**and after when i set a json filter its working perfect**

---

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [September 21, 2015, 11:16am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693/4 "2015-09-21T11:16:19Z")

</div>

**I found how to do it:**

**Original message:**

"{"InternalMessageQueueSize":5,"ExceptionsNumber":300,"test1":400,"EventDate":"2015-09-21T11:12:10.047Z"}"

mutate {  
gsub =\> ["message", "[\]", "_"]  
gsub =\> ["message", """, ""]  
gsub =\> ["message", "_", """]  
gsub =\> ["message", "[\]", ""]  
}  
json {  
source =\> "message"  
}

**And i get:**

{  
"message" =\> "{"InternalMessageQueueSize":5,"ExceptionsNumber":300,"test1":400,"EventDate":"2015-09-21T11:12:10.047Z"}",  
"@version" =\> "1",  
"@timestamp" =\> "2015-09-21T11:15:53.448Z",  
"type" =\> "app.metric",  
"tags" =\> [  
[0] "app.metric"  
],  
"InternalMessageQueueSize" =\> 5,  
"ExceptionsNumber" =\> 300,  
"test1" =\> 400,  
"EventDate" =\> "2015-09-21T11:12:10.047Z"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693/5 "2017-07-06T05:28:33Z")

</div>