Asterisk in Mutate with GSUB

Elastic Stack Logstash
3

@Suman_Reddy1 directly pinging individual members when they have not explicitly offered their help, is rude. Please refrain from doing this.

This shouldn't be taking down the whole process, but the mutate plugin explicitly warns about regex special characters in the gsub directive.

That said, I can't think of a reliable way to do string substitution using existing plugins.

Perhaps the Ruby filter may be our best bet here (the following is pseudo-configs and has not been tested):

filter {
  ruby {
    code => "
      message = event.get('message')
      message && begin
        docNumber = event.get('[docNumber]')
        docNumberMasked = event.get('[docNumberMasked]')
        event.set('message', message.tr(docNumber, docNumberMasked))
      end
    "
  }
}