# What filter in logstash should i use to remove the “\\” from non-Json field

**URL:** https://discuss.elastic.co/t/what-filter-in-logstash-should-i-use-to-remove-the-from-non-json-field/164645
**Category:** Logstash
**Created:** [January 17, 2019, 2:10pm UTC](https://discuss.elastic.co/t/what-filter-in-logstash-should-i-use-to-remove-the-from-non-json-field/164645 "2019-01-17T14:10:15Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Andrey\_Finkelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrey_finkelman/32/122505_2.png) [@Andrey\_Finkelman](https://discuss.elastic.co/u/Andrey_Finkelman)
#### Post date: [January 17, 2019, 2:10pm UTC](https://discuss.elastic.co/t/what-filter-in-logstash-should-i-use-to-remove-the-from-non-json-field/164645/1 "2019-01-17T14:10:16Z")

</div>

Hi all , i have sending output to Oracle DB , fields containing some XMLs , logstash adding "\" to all fields as escape character that increasing fields size drasticaly how to remove them from the fields ?  
Tried :  
mutate {  
gsub =\> [  
"parameterIN","\\","",  
"parameterOut","\\","",  
"additionalField1","\\","",  
"additionalField2","\\","",  
"additionalField3","\\",""  
]  
}

Getting Error  
if [type] == "xxxx\_processes" {\n\t\t\tmutate {\n\t\t\t\tgsub =\> [\n "parameterIN","\\","", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 17, 2019, 3:25pm UTC](https://discuss.elastic.co/t/what-filter-in-logstash-should-i-use-to-remove-the-from-non-json-field/164645/2 "2019-01-17T15:25:04Z")

</div>

See [this](https://github.com/elastic/logstash/issues/1645) issue and [this](https://github.com/elastic/logstash/pull/7442) fix. If [config.support\_escapes](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html) does not float your boat then the traditional workaround is

```
mutate { gsub => { "field", "[\\]", "" } }
```

---

<div class="post-metadata">

### Author: ![Andrey\_Finkelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrey_finkelman/32/122505_2.png) [@Andrey\_Finkelman](https://discuss.elastic.co/u/Andrey_Finkelman)
#### Post date: [January 20, 2019, 1:34pm UTC](https://discuss.elastic.co/t/what-filter-in-logstash-should-i-use-to-remove-the-from-non-json-field/164645/3 "2019-01-20T13:34:05Z")

</div>

thanks , worked for me

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 17, 2019, 1:34pm UTC](https://discuss.elastic.co/t/what-filter-in-logstash-should-i-use-to-remove-the-from-non-json-field/164645/4 "2019-02-17T13:34:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.