Can't replace character with Backslash with gsub

Elastic Stack Logstash
1

Hi all. I am trying to replace the pound character in a field value with the backslash but am truggling to get it to work. The field looks like this:

PoundedUNC => "##Network#Share#Name$" and I would like to turn it into "\\Network\Share\Name$"

When I use the filter: mutate { gsub => [ "PoundedUNC", "#", "\\"] }
It causes logstash to crash. But if I use: mutate { gsub => [ "PoundedUNC", "#", "[\\]"] },
Logstash starts properly but I get the result: [\][\]Network[\]Share[\]Name$"

I have tried many combinations but no luck. Any idea on how I can get it to work properly?

Thanks

2

As you have found, you cannot have a backslash as the last character in a quoted string. Using a character group is the normal trick for the pattern. If you use it in the replacement string it is a literal, not a group. So you could do

mutate {
    gsub => [
        "PoundedUNC", "#", "\]",
        "PoundedUNC", "]", ""
    ]
}

It does not have to be ], you can use any character that will never appear in the UNC.

3

Brilliant man!!! It worked like a charm.