i have log in below format , i need to replace ":" from 17:18:12 to 17-18-12 ...as this colon is also present at other places in line , how to match this
mutate { gsub => [ "message", "\d\d:\d\d:\d\d", "\d\d-\d\d-\d\d" ] does not work
Log
"This is a test:message however it was originated 17:18:12 but help:question abc "
That means the capture groups were empty, which means the original message just consisted of "\r". Your message does not contain what you think it contains.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.