Backward regex replacement with gsub filter option

(Rahul) #1

I want to match a text and replace it with matched value using gsub regex. we ususally do it using $1 which is regex backward reference.
the below code contain my requirement

    filter {
      mutate {
        gsub => [
          # replace all forward slashes with underscore
          "fieldname", "/", "_$1",
          # replace backslashes, question marks, hashes, and minuses
          # with a dot "."
          "fieldname2", "a", "$2bc"
        ]
      }
    }

thanks for reading and helping.

#2

Use \1 to refer to a capture group that uses parentheses ... for example

    mutate { add_field => { someField => "FooBarBaz" } }
    mutate { gsub => [ "someField", "Foo(.*)Baz", "\1" ] }

will result in "someField" containing "Bar"