# Trouble replacing a "||"

**URL:** https://discuss.elastic.co/t/trouble-replacing-a/45202
**Category:** Logstash
**Created:** [March 23, 2016, 10:00am UTC](https://discuss.elastic.co/t/trouble-replacing-a/45202 "2016-03-23T10:00:55Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![noemie](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@noemie](https://discuss.elastic.co/u/noemie)
#### Post date: [March 23, 2016, 10:00am UTC](https://discuss.elastic.co/t/trouble-replacing-a/45202/1 "2016-03-23T10:00:55Z")

</div>

Hello,

in some of my log lines, I have two pipes following each other but between is supposed to be a field. Processing this particularity with my grok pattern doesn't do the trick. I've tried the following:  
gsub =\> ["temp\_field" , "||" , "|-|"]  
gsub =\> ["temp\_field" , "||" , "|-|"]  
gsub =\> ["temp\_field" , "||" , "|_|"]  
gsub =\> ["temp\_field" , "||" , "|_|"]  
gsub =\> ["temp\_field" , "||" , "|\_|"]

with the last one, it changes my field by adding exactly "|_|" sequence but the point is to have "|_|". I'm struggling with this for quite some time.

Do anyone have a solution for this?

Thanks in advance,  
Noemie

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/trouble-replacing-a/45202/2 "2017-07-06T05:05:44Z")

</div>