Gsub not working to remove | (vertical bar/piper)

Elastic Stack Logstash
1

hey i've been religiously trying to figure out how to remove the vertical bar from my log entries.

		gsub => [ "message", "/\|/g", " "]

no luck

2 
gsub => [ "message", "\|", " "]
3

I tried that first, no luck

4

eg.

local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0|AlgoSec|FireFlow|v6.11.420-b159|Log|Log|0|

trying to replace the | with a empty space

5

Works for me. With this config

input { stdin {} }
filter { mutate { gsub => [ "message", "\|", " " ] } }
output { stdout { codec => rubydebug } }

run using

echo 'local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0|AlgoSec|FireFlow|v6.11.420-b159|Log|Log|0|' | /usr/share/logstash/bin/logstash -f test.conf

I get

       "message" => "local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0 AlgoSec FireFlow v6.11.420-b159 Log Log 0 "
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.