Gsub not replacing pattern on "url.original" field

Hi,
I am trying to modify the filebeat-7.5.0-apache-access-default my goal is to remove part of the url.original field using gsub but then when simulating I dont see any change.

So far my procedure was

  1. Deleting the current filebeat-7.5.0-apache-access-default in ES.
  2. Posting a modified version, the only change is I added a gsub processor in the list:
    {
        "gsub": {
            "field": "url.original",
            "pattern": "\\&r(.*)",
            "replacement": ""
        }
    },
    

The idea is to remove everything from and after "&r" e.g. /products?s=soap&r=sometoken
I simulate it after and the url.original field is unchanged, any ideas? Thank you!!

how about using the dissect processor to not deal with regexes?

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "dissect": {
          "field": "url.original",
          "pattern": "%{original_url}?%{params}"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "url": {
          "original": "https://example.org/products?s=soap&r=sometoken"
        }
      }
    }
  ]
}

I haven't thought of that! thank you!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.