Gsub with regex

Elastic Stack Elastic Agent
1

Hi,

My regex is matching my condition on my ingest pipeline, however I am struggling to wrap my found string with quotes for the replacement.

expression.

    "gsub": {
      "field": "message",
      "pattern": "\b[0-9]+\b(?!')",
      "replacement": """\\1"""

Sample data.

'eventId': '82102699', 'status': 'Live-Processing', 'duration': 904, 'eventStartTime': '1673052296'

The regex works and I can replace the 904, What I can't work out is how to provide this value as 'number' e.g. '904'. escaping the value with the backslashes means I end up with a literal '\1' as the value, any ideas?

2

I fixed it with

"gsub": {
  "field": "message",
  "pattern": "(\\b[0-9]+\\b(?!'))",
  "replacement": "'$1'"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.