Filter empty line with just \r in it


(Павел Песецкий) #1

Hi, there is a task to filter out the result with just "\r" in json represenmtation

I tried the following code to filter:
if [Message] =~ /^\r$/ {
mutate {
add_field => {
"new_field" => "should be filtered"
}
}
}

But it also filters out he valid data like:

if I try:
if [Message] == "\r" {
mutate {
add_field => {
"new_field" => "should be filtered"
}
}
}

It filters nothing.

Can anyone advise?


(Vincent Tran) #2

Try if [Message] == "\\r"

irb(main):012:0> unescaped = "\r"
=> "\r"
irb(main):013:0> escaped = "\\r"
=> "\\r"
irb(main):014:0> puts unescaped

=> nil
irb(main):015:0> puts escaped
\r
=> nil
irb(main):016:0> escaped=="\r"
=> false
irb(main):017:0> escaped=="\\r"
=> true
irb(main):018:0>

(system) #3