GROK | Problem ingest Pipeline | replace

I am new in the Commutiy and new in the topic GROK.
I have a message where I want to replace a certain string. The problem the string contains the GROK meta character ^.
The whole thing is supposed to happen in an ingest pipeline in the ES cluster.

Here is an example:


This should become
cat /etc/passwd | grep "Thomas"

So the ^@ should be replaced by a space.
I have no idea how to do this.

Thanks for your time and help

Translated with DeepL Translate: The world's most accurate translator (free version)



  "description": "_description",
  "processors": [
      "gsub" : {
        "field" : "yourField",
        "pattern" : "\\^@",
        "replacement": " "

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.