Filling value into placeholder in a field

Elastic Stack Logstash
1

Hi ,
I have a field named 'message'. This field contains data like,

  message : 'My IP is {%source_ip}.This {%source.ip} is external ip.'

I want to replace all the instance of this placeholder {%source_ip} , with a value. Can anybody
help me how to do this.

2

Use mutate+gsub.

3

Thank you @Badger ,
I tried doing this ,
mutate {
gsub => [

      "message", "{%source.ip}", "1.1.1.1",
    ]
  }

And the source ip got replaced , but in my scenario ,the value to be replaced is not predefined ( ie 1.1.1.1). I want to replace this with value of another field that is.("source. ip").

For example:

"newfield" : "12.12.12.1" 

                        mutate {
    gsub => [
      
      "message", "{%source.ip}", "<value of the newfield>",
    ]
  }

Any help how can i get this ?

4

You may be able to use a sprintf reference. If gsub does not do the sprintf you may be able to make mutate+copy process the reference that you gsub in.

5

Thanks a ton @badger it worked. :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.