Find and replace to a unicode string

The logstash configuration language does not provide a way to specify UTF-8 characters. You will need to use a ruby filter to do the gsub

ruby { code => 'event.set("message", event.get("message").gsub(/\|/, "\0001".encode("utf-8")))' }