Find and replace to a unicode string

Elastic Stack Logstash
1

Hi,

I am trying to do a find and replace using mutate to replace | (vertical bar) with Unicode u0001 (start of header) anywhere in the source message before being further parsed.

I have tried various combinations of forward slashes and back slashes but cannot get it to replace with the string "\u0001"

The code below replaces with double backslashes "\u0001"

    mutate {
         gsub => ["message", "\|", "\u0001"]
     }
2

The logstash configuration language does not provide a way to specify UTF-8 characters. You will need to use a ruby filter to do the gsub

ruby { code => 'event.set("message", event.get("message").gsub(/\|/, "\0001".encode("utf-8")))' }
3

That worked perfectly, thanks for your help!