How to remove “” in logstash?
up vote
0
down vote
favorite
I am new to the Logstash, I need to remove from request and Http_method
request": ""GET https://www.vvvvvv HTTP/2.0""
http_method": ""GET"
Expected results:
request": "GET https://www.vvvvvvv HTTP/2.0""
http_method": "GET"
Could you please help me?
logstash logstash-grok
edited Nov 20 at 11:52
barbsan
2,14811122
asked Nov 20 at 10:49
ARUN R
61
add a comment |
up vote
0
down vote
favorite
I am new to the Logstash, I need to remove from request and Http_method
request": ""GET https://www.vvvvvv HTTP/2.0""
http_method": ""GET"
Expected results:
request": "GET https://www.vvvvvvv HTTP/2.0""
http_method": "GET"
Could you please help me?
logstash logstash-grok
edited Nov 20 at 11:52
barbsan
2,14811122
asked Nov 20 at 10:49
ARUN R
61
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I am new to the Logstash, I need to remove from request and Http_method
request": ""GET https://www.vvvvvv HTTP/2.0""
http_method": ""GET"
Expected results:
request": "GET https://www.vvvvvvv HTTP/2.0""
http_method": "GET"
Could you please help me?
logstash logstash-grok
edited Nov 20 at 11:52
barbsan
2,14811122
asked Nov 20 at 10:49
ARUN R
61
I am new to the Logstash, I need to remove from request and Http_method
request": ""GET https://www.vvvvvv HTTP/2.0""
http_method": ""GET"
Expected results:
request": "GET https://www.vvvvvvv HTTP/2.0""
http_method": "GET"
Could you please help me?
logstash logstash-grok
logstash logstash-grok
edited Nov 20 at 11:52
barbsan
2,14811122
asked Nov 20 at 10:49
ARUN R
61
edited Nov 20 at 11:52
barbsan
2,14811122
asked Nov 20 at 10:49
ARUN R
61
edited Nov 20 at 11:52
barbsan
2,14811122
edited Nov 20 at 11:52
barbsan
2,14811122
edited Nov 20 at 11:52
barbsan
2,14811122
2,14811122
asked Nov 20 at 10:49
ARUN R
61
asked Nov 20 at 10:49
ARUN R
61
asked Nov 20 at 10:49
ARUN R
61
61
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
Assuming that this is an event that is being parsed from a log file, when you are processing your events, in the filter plugin, you can use the gsub in mutate filter plugin to process it appropriately.
filter
{
mutate {
gsub => ["message","[\]",""]
}
}
This would replace all the backslashes to empty string in the event.
answered Nov 20 at 15:51
scarvish
11
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53391350%2fhow-to-remove-in-logstash%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
Assuming that this is an event that is being parsed from a log file, when you are processing your events, in the filter plugin, you can use the gsub in mutate filter plugin to process it appropriately.
filter
{
mutate {
gsub => ["message","[\]",""]
}
}
This would replace all the backslashes to empty string in the event.
answered Nov 20 at 15:51
scarvish
11
add a comment |
up vote
0
down vote
Assuming that this is an event that is being parsed from a log file, when you are processing your events, in the filter plugin, you can use the gsub in mutate filter plugin to process it appropriately.
filter
{
mutate {
gsub => ["message","[\]",""]
}
}
This would replace all the backslashes to empty string in the event.
answered Nov 20 at 15:51
scarvish
11
add a comment |
up vote
0
down vote
up vote
0
down vote
Assuming that this is an event that is being parsed from a log file, when you are processing your events, in the filter plugin, you can use the gsub in mutate filter plugin to process it appropriately.
filter
{
mutate {
gsub => ["message","[\]",""]
}
}
This would replace all the backslashes to empty string in the event.
answered Nov 20 at 15:51
scarvish
11
Assuming that this is an event that is being parsed from a log file, when you are processing your events, in the filter plugin, you can use the gsub in mutate filter plugin to process it appropriately.
filter
{
mutate {
gsub => ["message","[\]",""]
}
}
This would replace all the backslashes to empty string in the event.
answered Nov 20 at 15:51
scarvish
11
answered Nov 20 at 15:51
scarvish
11
answered Nov 20 at 15:51
scarvish
11
answered Nov 20 at 15:51
scarvish
11
11
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53391350%2fhow-to-remove-in-logstash%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
