Hi, you need a very tricky substitution
The only way of achieving it that comes to my mind is to use ruby code directly:
ruby{
code => ' event.set("message", event.get("message").gsub("/", "\\") ) '
}
Be aware that if your output representation escapes special characters (for example Json), you'll see "doubled" backquotes in the result.
I add a link to a message with a related issue to have as reference and another unresolved one that might benefit from this.
Having a backslash at the end of a string requires a trick. Use a character group that just includes backslash...
mutate { gsub => [ "[user][name]", "\w+[\\]{2}", "" ] }
Hi, I have following stuff in a field:
"field_A" => "c:\\test\\test.txt"
By some conversion the masking backslash became a valid character.
How can I get rid of the double backslashes, so that I have only one (or two when masked)?
I tried:
mutate
{
gsub =>
[
'field_A', '(\\\\)', '\\'
]
}
but that is not accepted by logstash.
If I try to replace to '[\]' then the brackets are also inserted.
Any idea?
Thanks a lot.
