Gsub not replacing pattern on "url.original" field

[blinx (Carlos Bellino)]

Hi,
I am trying to modify the filebeat-7.5.0-apache-access-default my goal is to remove part of the url.original field using gsub but then when simulating I dont see any change.

So far my procedure was

1. Deleting the current filebeat-7.5.0-apache-access-default in ES.
2. Posting a modified version, the only change is I added a gsub processor in the list:

   {
       "gsub": {
           "field": "url.original",
           "pattern": "\\&r(.*)",
           "replacement": ""
       }
   },
   

The idea is to remove everything from and after "&r" e.g. /products?s=soap&r=sometoken
I simulate it after and the url.original field is unchanged, any ideas? Thank you!!

[spinscale (Alexander Reelsen)]

how about using the dissect processor to not deal with regexes?

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "dissect": {
          "field": "url.original",
          "pattern": "%{original_url}?%{params}"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "url": {
          "original": "https://example.org/products?s=soap&r=sometoken"
        }
      }
    }
  ]
}

[blinx (Carlos Bellino)]

I haven't thought of that! thank you!!