GSUB & Regular Expression

I have a text field being ingested that I want to remove an email disclaimer from, unfortunately, I can't figure out the correct syntax to remove it. I've got the mutate filter setup in the following way:

mutate {
  gsub => [
    "notes", 'Disclaimer[\s\S]*?\.(\n|$)', ''
  ]
}

The disclaimer shows in Kibana table view like this:

Disclaimer

The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.

In Kibana JSON view, it looks like this:

Disclaimer\n\nThe information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.\n

That's all correct...the field I was targeting was capitalized... :man_facepalming:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.