Handle space in a field

Elastic Stack Logstash
1

I am trying to remove a space from a field in logstash but it's not working, because there is space in the field, I can't even rename the field or not able to do replacement is with gsub.

Request ID to be renamed to Request_ID to use this field as document id in output filter. please help, thank you

  mutate {
        gsub => [ "[response][body][values][Request ID]", ' ', "_" ]
    }
2

Gsub does not works on fields names, only on the values that are stored in the fields.

Have you tried using rename to rename the field?

mutate {
    rename => {
        "[response][body][values][Request ID]" => "[response][body][values][Request_ID]"
    }
}
3

Its working now, I don't know I was doing the same but couldn't do it. might be using wrong braces.

Thanks, really appreciate..

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.