Gsub not working to remove | (vertical bar/piper)


(Kabilan) #1

hey i've been religiously trying to figure out how to remove the vertical bar from my log entries.

		gsub => [ "message", "/\|/g", " "] 

no luck


#2
gsub => [ "message", "\|", " "]

(Kabilan) #3

I tried that first, no luck


(Kabilan) #4

eg.

local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0|AlgoSec|FireFlow|v6.11.420-b159|Log|Log|0|

trying to replace the | with a empty space


#5

Works for me. With this config

input { stdin {} }
filter { mutate { gsub => [ "message", "\|", " " ] } }
output { stdout { codec => rubydebug } }

run using

echo 'local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0|AlgoSec|FireFlow|v6.11.420-b159|Log|Log|0|' | /usr/share/logstash/bin/logstash -f test.conf

I get

       "message" => "local0--info--AFA-STE--CEF--2018-02-10T12:00:33-05:00--0 AlgoSec FireFlow v6.11.420-b159 Log Log 0 "

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.