How can i replace multiple special characters in all fields?

Elastic Stack Logstash
2

If it is a fixed set of fields you could do it in a mutate filter. If you really want to do it to all fields and you do not know what those fields will be you would have to use ruby

    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v.is_a? String
                    event.set(k, v.gsub("Ç", "Ç").gsub("ç", "ç").gsub("Ş", "Ş").gsub("ş", "ş").gsub("İ", "İ").gsub("ı", "ı").gsub("Ü", "Ü").gsub("ü", "ü").gsub("Ö", "Ö").gsub("ö", "ö").gsub("Ğ", "Ğ").gsub("ğ", "ğ"))
                end
            }
        '
    }

If you want to handle more HTML entities you might be better off rewriting that loop to use something like htmlentities. If you need to handle fields nested in objects you would have to write a recursive function. There is an example of walking through all fields in an event here.

1 Like