Skip to content

Instantly share code, notes, and snippets.

@pauloconnor
Last active Jun 7, 2022
Embed
What would you like to do?
Logstash Mutate Filter for stripping Linux color codes from log files
# Get rid of color codes
mutate {
gsub => ["message", "\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]", ""]
}
@JasonIamAUnixAdmin
Copy link

JasonIamAUnixAdmin commented Oct 7, 2016

FYI to get this to work I needed to pull out the @ but thanks!

@julianogalgaro
Copy link

julianogalgaro commented Feb 8, 2017

Thanks!

@Wolfant
Copy link

Wolfant commented Jul 13, 2017

really usefull thanks

@immatt2015
Copy link

immatt2015 commented Jan 23, 2018

Thanks

@Darwiner
Copy link

Darwiner commented Feb 15, 2018

Also removed @ from @message for compatibility with newer logstash versions. Otherwise, works perfectly. Thanks!

@seancheung
Copy link

seancheung commented Mar 5, 2018

This also strips text in between

EDIT: turns out to be my bad. :) This works fine!

@matutter
Copy link

matutter commented Jun 24, 2018

I've been looking for this for hours, thanks!

@guyav
Copy link

guyav commented Oct 31, 2018

Thanks!
As mentioned in previous comments, I had to remove the @ to get it working on Logstash 6.4.2.

@ns-smehra
Copy link

ns-smehra commented May 6, 2020

How does this work though ?

@konart
Copy link

konart commented May 8, 2020

How does this work though ?

Well it literally removes ANSI color codes from the message field with gsub.

@abhinav1107
Copy link

abhinav1107 commented Oct 23, 2021

works like a charm.

@nirmalgamage
Copy link

nirmalgamage commented Jun 7, 2022

I tried with this example but seems not working for me.
My log example : " [2m2022-06-06 10:16:41.057[0;39m [32m INFO[0;39m [35m11219[0;39m [2m---[0;39m [2m["

My filter section is given below

filter {
mutate {
gsub => ["message", "\x1B[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]", ""]
}
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:date}%{SPACE}%{GREEDYDATA:rest}" remove_field => ["message"] }
}
date {
match => ["date", "ISO8601"]
target => "date_object"
}
ruby{
code =>'event.set("@timestamp", event.get("date_object").to_i)'
}

}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment