Add a backslash at the end of a string

[Florent_Fauvin (Fauvin)]

Hello,

I want to add a backslash at the end of a field value, but logstash does not allow it:

  `mutate { add_field => { "[prefix]" => "%{[domain]}\\"}}`

Do you know how I could add a backslash at the end of the string?

Thank you very much,

Florent

[Badger]

@Florent_Fauvin

Do you know how I could add a backslash at the end of the string?

The way the logstash configuration parser works makes a backslash at the end of a string a problem. If you wanted to remove a backslash from a field there is a trick to do that -- use a character group that contains a single backslash

mutate { gsub => [ "someField", "[\\]$", "" ] }

but you cannot use character groups in a replacement string, so that would not work here. I have not tested it, but it might work if you use a ruby filter, where the parser is looking for a string in single quotes

ruby {
    code => '
        event.set("prefix", event.get("domain") + "\\")
    '
}

[Florent_Fauvin (Fauvin)]

It looks like a need so common, that I find it crazy that logstash does not allow it ...