Gsub replace based on pattern

Elastic Stack Logstash
1

i have log in below format , i need to replace ":" from 17:18:12 to 17-18-12 ...as this colon is also present at other places in line , how to match this

mutate { gsub => [ "message", "\d\d:\d\d:\d\d", "\d\d-\d\d-\d\d" ] does not work

Log

"This is a test:message however it was originated 17:18:12 but help:question abc "

2

Hello Muhammad,

Welcome to this forum! :partying_face:

I have not tried it but something like this should work:

mutate { gsub => [ "message", "(\d\d):(\d\d):(\d\d)", "$1-$2-$3" ] }

The brackets in the first regex mark groups which can be referenced later by using $x.

Best regards
Wolfram

3

not working , it gives output

"message" => "$1-$2-$3\r",

4

ruby use \1 etc. to reference capture groups. It does not use the perl syntax of $1 etc. Try

mutate { gsub => [ "message", "(\d\d):(\d\d):(\d\d)", "\1-\2-\3" ] }
5

still not working i am getting below output

"message" => "--\r"

if my input message has 17:18:12 , i need to replace it and display as 17-18-12

6

That means the capture groups were empty, which means the original message just consisted of "\r". Your message does not contain what you think it contains.

7

@Muhammad_Faisal I am sorry, I was not aware of the difference between Ruby and other Regex implementations.

8

thanks Badger its working.