Gsub not replacing pattern on "url.original" field

Elastic Stack Elasticsearch
1

Hi,
I am trying to modify the filebeat-7.5.0-apache-access-default my goal is to remove part of the url.original field using gsub but then when simulating I dont see any change.

So far my procedure was

  1. Deleting the current filebeat-7.5.0-apache-access-default in ES.
  2. Posting a modified version, the only change is I added a gsub processor in the list:
    {
    "gsub": {
        "field": "url.original",
        "pattern": "\\&r(.*)",
        "replacement": ""
    }
},

The idea is to remove everything from and after "&r" e.g. /products?s=soap&r=sometoken
I simulate it after and the url.original field is unchanged, any ideas? Thank you!!

2

how about using the dissect processor to not deal with regexes?

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "dissect": {
          "field": "url.original",
          "pattern": "%{original_url}?%{params}"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "url": {
          "original": "https://example.org/products?s=soap&r=sometoken"
        }
      }
    }
  ]
}
3

I haven't thought of that! thank you!!