What filter in logstash should i use to remove the “\” from non-Json field

Elastic Stack Logstash
1

Hi all , i have sending output to Oracle DB , fields containing some XMLs , logstash adding "\" to all fields as escape character that increasing fields size drasticaly how to remove them from the fields ?
Tried :
mutate {
gsub => [
"parameterIN","\\","",
"parameterOut","\\","",
"additionalField1","\\","",
"additionalField2","\\","",
"additionalField3","\\",""
]
}

Getting Error
if [type] == "xxxx_processes" {\n\t\t\tmutate {\n\t\t\t\tgsub => [\n "parameterIN","\\","", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}

2

See this issue and this fix. If config.support_escapes does not float your boat then the traditional workaround is

mutate { gsub => { "field", "[\\]", "" } }
3

thanks , worked for me

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.