Gsub doesn't replace the given char

Elastic Stack Logstash
1

Hi Team,

I'm trying to replace a char with another char in a string field, but it doesn't looks like it is doing the job, please is there anyone to help me in correcting this.

Here is an example of what I'm doing ,

"source_query": "{\"from\":0,\"size\":10,\"query\":{\"bool\":{\"must\":[{\"query_string\":{\"query\":\"(\\\"testData\\\"^20.000000 OR testData*^10.000000 OR *testData*) AND (\\\"testData\\\\:\\\"^20.000000 OR testData\\\\:*^10.000000 OR *testData\\\\:*) AND (\\\"testData\\\"^20.000000 OR testData*^10.000000 OR *testData*)\",\"fields\":[\"testOrder.contactPhones^1.0\",\"testOrder.personPhones^1.0\",\"ownerOrder.contactPhones^1.0\",\"ownerOrder.xxxxxxxxPhones^1.0\",\"globalCopyField^1.0\",\"p0AttrCopyField^1.8\",\"phone^1.0\"],\"type\":\"best_fields\",\"default_operator\":\"or\",\"max_determinized_states\":10000,\"enable_position_increments\":true,\"fuzziness\":\"AUTO\",\"fuzzy_prefix_length\":0,\"fuzzy_max_expansions\":50,\"phrase_slop\":0,\"escape\":false,\"auto_generate_synonyms_phrase_query\":true,\"fuzzy_transpositions\":true,\"boost\":1.0}}],\"filter\":[{\"bool\":{\"must\":[{\"terms\":{\"contextType\":[\"testData\"],\"boost\":1.0}},{\"term\":{\"active\":{\"value\":true,\"boost\":1.0}}},{\"term\":{\"deleted\":{\"value\":false,\"boost\":1.0}}},{\"bool\":{\"should\":[{\"term\":{\"requiredOrderId\":{\"value\":testData,\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},\"version\":true,\"sort\":[{\"_score\":{\"order\":\"desc\"}},{\"updatedAt\":{\"order\":\"desc\",\"missing\":\"_last\",\"unmapped_type\":\"long\"}},{\"createdAt\":{\"order\":\"desc\",\"missing\":\"_last\",\"unmapped_type\":\"long\"}}]}"

trying to replace " with " using gsub like below

mutate{
                gsub => ["source_query","\\\"","\""]
              }

Thanks,
Vaseem

2

Hi,

You are trying to replace a value by herself.
Indeed, in a string \" is print \\\".
If you want to remove all \ use this :

mutate {
  gsub => [
    "source_query", "[\\]+[\"]", '"' # one double quote between two single quote
  ]
}

Cad.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.