I have a text field being ingested that I want to remove an email disclaimer from, unfortunately, I can't figure out the correct syntax to remove it. I've got the mutate filter setup in the following way:
mutate {
gsub => [
"notes", 'Disclaimer[\s\S]*?\.(\n|$)', ''
]
}
The disclaimer shows in Kibana table view like this:
Disclaimer
The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.
In Kibana JSON view, it looks like this:
Disclaimer\n\nThe information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.\n