Hi all. I am trying to replace the pound character in a field value with the backslash but am truggling to get it to work. The field looks like this:
PoundedUNC => "##Network#Share#Name$" and I would like to turn it into "\\Network\Share\Name$"
When I use the filter: mutate { gsub => [ "PoundedUNC", "#", "\\"] }
It causes logstash to crash. But if I use: mutate { gsub => [ "PoundedUNC", "#", "[\\]"] },
Logstash starts properly but I get the result: [\][\]Network[\]Share[\]Name$"
I have tried many combinations but no luck. Any idea on how I can get it to work properly?
As you have found, you cannot have a backslash as the last character in a quoted string. Using a character group is the normal trick for the pattern. If you use it in the replacement string it is a literal, not a group. So you could do
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.