Hey i want to add some text into my message can anybody help me how to do it?

[jolaniya]

Hey i want to add some text into my message can anybody help me how to do it?

[Badger]

Maybe using a mutate filter. You can add fields or tags, and the gsub option can modify fields.

[jolaniya]

@Badger

option

Hi Thankyou Badger for your reply.

I have used the update option but this replaced my whole message. I just want to put some additional text after the message. Can you please tell me in detail how to use gsub option for field modification? One more thing I wanna add I have xml data and I guess gsub supported only strings or arrays of strings.

[Kurt_S (Kurt Schraeyen)]

Have you tried the replace function?

Something like this should work:

filter {
  mutate {
    replace => { "message" => "%{message} extra text" }
  }
}

[jolaniya]

hi thanks for contributing!

This works for me