Handle space in a field

I am trying to remove a space from a field in logstash but it's not working, because there is space in the field, I can't even rename the field or not able to do replacement is with gsub.

Request ID to be renamed to Request_ID to use this field as document id in output filter. please help, thank you

  mutate {
        gsub => [ "[response][body][values][Request ID]", ' ', "_" ]
    }

Gsub does not works on fields names, only on the values that are stored in the fields.

Have you tried using rename to rename the field?

mutate {
    rename => {
        "[response][body][values][Request ID]" => "[response][body][values][Request_ID]"
    }
}

Its working now, I don't know I was doing the same but couldn't do it. might be using wrong braces.

Thanks, really appreciate..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.