GROK | Problem ingest Pipeline | replace

[Walli]

Hello,
I am new in the Commutiy and new in the topic GROK.
I have a message where I want to replace a certain string. The problem the string contains the GROK meta character ^.
The whole thing is supposed to happen in an ingest pipeline in the ES cluster.

Here is an example:

cat^@/etc/passwd^@|^@grep^@"Thomas"

This should become
cat /etc/passwd | grep "Thomas"

So the ^@ should be replaced by a space.
I have no idea how to do this.

Thanks for your time and help

Translated with DeepL Translate: The world's most accurate translator (free version)

[Tomo_M (Tomohiro Mitani)]

Hi,

Try

{
  "description": "_description",
  "processors": [
    {
      "gsub" : {
        "field" : "yourField",
        "pattern" : "\\^@",
        "replacement": " "
      }
    }
  ]
}