Gsub replace backslash with forward slash

[sjivan (Sanjiv Jivan)]

Hi,
I'm trying to replace a forward slash to back slash using gsub but can't get it to work.

I've tried

gsub => ["message", "/", "\\"]

and

gsub => ["message", "/", "\"]

The above fails with a parse error.

and

gsub => ["message", "[/]", "[\\]"]

does the wrong thing by adding the brackets in the substituted string.

Any pointers would be appreciated.

Thanks,
Sanjiv

[andres-perez (Andrés Pérez)]

Hi, you need a very tricky substitution

The only way of achieving it that comes to my mind is to use ruby code directly:

  ruby{
    code => ' event.set("message", event.get("message").gsub("/", "\\") ) '
  }

Be aware that if your output representation escapes special characters (for example Json), you'll see "doubled" backquotes in the result.

I add a link to a message with a related issue to have as reference and another unresolved one that might benefit from this.

Proper RegEx with Mutate>GSub

Having a backslash at the end of a string requires a trick. Use a character group that just includes backslash... mutate { gsub => [ "[user][name]", "\w+[\\]{2}", "" ] }

Logstash gsub: how to replace with backslash?

Hi, I have following stuff in a field: "field_A" => "c:\\test\\test.txt" By some conversion the masking backslash became a valid character. How can I get rid of the double backslashes, so that I have only one (or two when masked)? I tried: mutate { gsub => [ 'field_A', '(\\\\)', '\\' ] } but that is not accepted by logstash. If I try to replace to '[\]' then the brackets are also inserted. Any idea? Thanks a lot.

[sjivan (Sanjiv Jivan)]

That's exactly what I resorted to after many tries. I figured I was doing something wrong as replacing forward slash with backslash is a seemingly simple requirement.

Thanks!