Hey i want to add some text into my message can anybody help me how to do it?

Hey i want to add some text into my message can anybody help me how to do it?

Maybe using a mutate filter. You can add fields or tags, and the gsub option can modify fields.

Hi Thankyou Badger for your reply.

I have used the update option but this replaced my whole message. I just want to put some additional text after the message. Can you please tell me in detail how to use gsub option for field modification? One more thing I wanna add I have xml data and I guess gsub supported only strings or arrays of strings.

Have you tried the replace function?

Something like this should work:

filter {
  mutate {
    replace => { "message" => "%{message} extra text" }
  }
}

hi thanks for contributing!

This works for me