Gsub not working to remove | (vertical bar/piper)

hey i've been religiously trying to figure out how to remove the vertical bar from my log entries.

		gsub => [ "message", "/\|/g", " "] 

no luck

gsub => [ "message", "\|", " "]

I tried that first, no luck

eg.

local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0|AlgoSec|FireFlow|v6.11.420-b159|Log|Log|0|

trying to replace the | with a empty space

Works for me. With this config

input { stdin {} }
filter { mutate { gsub => [ "message", "\|", " " ] } }
output { stdout { codec => rubydebug } }

run using

echo 'local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0|AlgoSec|FireFlow|v6.11.420-b159|Log|Log|0|' | /usr/share/logstash/bin/logstash -f test.conf

I get

       "message" => "local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0 AlgoSec FireFlow v6.11.420-b159 Log Log 0 "

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.