Gsub - Basic example

I'm trying to use gsub with a very simple example and it doesn't work.

I just want to replace "ef" with "AA" with this example:

  mutate {
    add_field => { "field1" => "abc def ghi jkl" }
    gsub => ["field1", "ef","AA" ]

Could you tell me what is not working please?

Thank you very much,


gsub is an option of the mutate filter. add_field is a common option for every kind of filter that is executed if the filter has been successfull. Therefore it is executed after gsub. Your field doesn't yet exist when gsub is executed. So you'll have to split that up into two mutate filters.

Thank you, it works!