# Trying to add ruby filter to remove leading zero
**URL:** https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901
**Category:** Logstash
**Created:** [February 18, 2019, 9:13pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901 "2019-02-18T21:13:14Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [February 18, 2019, 9:13pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/1 "2019-02-18T21:13:14Z")
I have the following the json message.
```auto
{
"eventData" : {
"commandContext" : {
"eventUserId" : "system",
"eventOrigin" : "java",
"eventQueueMgr" : "TEST1",
"eventAccountingToken" : 0000000000000000000000000000000000000000000000000000000000000000,
"eventApplIdentity" : "",
"eventApplType" : "Unix",
"eventApplName" : "aixutil",
"eventApplOrigin" : "",
"command" : "Inquire"
}
}
}
```
Trying to remove the leading zero as logstash is throwing error. Cannot adjust the source.
I am trying to achieve this by adding a ruby filter to replace the `0` to `' '`.
Need some assistance on how to write the script.
logstash conf is -
```auto
filter {
ruby {
code => "str.sub!([eventData][commandContext][eventAccountingToken], "")"
}
json {
source => "message"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2019, 9:48pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/2 "2019-02-18T21:48:59Z")
> [@paano](#):
>
> [eventData][commandContext][eventAccountingToken]
The JSON has not been parsed when the ruby filter executes, so that field does not exist at that point. You can remove leading zeroes from fields using
```
mutate { gsub => ["message", " 0*([0-9]+),", " \1," ] }
```
---
### Author:  [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [February 18, 2019, 10:10pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/3 "2019-02-18T22:10:11Z")
@Badger it works.
IF i would use ruby filter, how would i implement. I am trying to learn using rubyfilter. ANy suggestion
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2019, 10:23pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/4 "2019-02-18T22:23:20Z")
```
ruby { code => ' event.set("message", event.get("message").gsub(/ 0*([0-9]+),/, " \\1,")) ' }
```
---
### Author:  [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [February 19, 2019, 5:11pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/5 "2019-02-19T17:11:49Z")
@Badger if i had to remove the field completely before the json parse. is there a way in logstash. And also convert field to `string` in `gsub`.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 19, 2019, 5:36pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/6 "2019-02-19T17:36:01Z")
You could use mutate+gsub to remove eventAccountingToken from the message before parsing.
If you want to convert the field to a string use mutate+convert.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2019, 5:36pm UTC](https://discuss.elastic.co/t/trying-to-add-ruby-filter-to-remove-leading-zero/168901/7 "2019-03-19T17:36:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.