Skip to content

Instantly share code, notes, and snippets.

Last active Jun 7, 2022
What would you like to do?
Logstash Mutate Filter for stripping Linux color codes from log files
# Get rid of color codes
mutate {
gsub => ["message", "\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]", ""]
Copy link

JasonIamAUnixAdmin commented Oct 7, 2016

FYI to get this to work I needed to pull out the @ but thanks!

Copy link

julianogalgaro commented Feb 8, 2017


Copy link

Wolfant commented Jul 13, 2017

really usefull thanks

Copy link

immatt2015 commented Jan 23, 2018


Copy link

Darwiner commented Feb 15, 2018

Also removed @ from @message for compatibility with newer logstash versions. Otherwise, works perfectly. Thanks!

Copy link

seancheung commented Mar 5, 2018

This also strips text in between

EDIT: turns out to be my bad. :) This works fine!

Copy link

matutter commented Jun 24, 2018

I've been looking for this for hours, thanks!

Copy link

guyav commented Oct 31, 2018

As mentioned in previous comments, I had to remove the @ to get it working on Logstash 6.4.2.

Copy link

ns-smehra commented May 6, 2020

How does this work though ?

Copy link

konart commented May 8, 2020

How does this work though ?

Well it literally removes ANSI color codes from the message field with gsub.

Copy link

abhinav1107 commented Oct 23, 2021

works like a charm.

Copy link

nirmalgamage commented Jun 7, 2022

I tried with this example but seems not working for me.
My log example : " [2m2022-06-06 10:16:41.057[0;39m [32m INFO[0;39m [35m11219[0;39m [2m---[0;39m [2m["

My filter section is given below

filter {
mutate {
gsub => ["message", "\x1B[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]", ""]
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:date}%{SPACE}%{GREEDYDATA:rest}" remove_field => ["message"] }
date {
match => ["date", "ISO8601"]
target => "date_object"
code =>'event.set("@timestamp", event.get("date_object").to_i)'


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment