since we are moving from logstash pipeline into ingest pipeline we had to rewrite our gsub pattern from logstash into ingest processors.
Our use case is simple, replace the unicode \u2028 into a newline character (\n), in order to correctly show the content of multiple line message (for example stacktraces).
In particular before we had:
# Replace the unicode \u2028 with \n, which Kibana will display as a new line (we write \u2028 that we recive a full logevent instead of \n)
gsub => [ "message", '\u2028', "
" # Seems that passing a string with an actual newline in it is the only way to make gsub work.
And now we are defining it using ingest pipeline -> gsub processor:
"description": "Replace the unicode \u2028 to return character",
Unfortunately this populate the message with string "\n" in the message, couldn't find a way to add newline character that works out.