How to parse names like "This+is+name%2+field" in links?

Elastic Stack Logstash
1

Hi! I have a name field like:
"This+is+name%2+field"

How can I parse it in logstash grok filters so that I can have:
"This is name 2 field" in Kibana?

2

Hi,

Use gsub option of mutate filter instead

mutate {
  gsub => [
    "field", "[+%]", " "
  ]
}

Cad

1 Like
3

Hey, Thank you. just one more question: should I use the strip plugin to remove the extra spaces in this mutate filter?

4

Hey, Thank you. just one more question: should I use strip plugin to remove extra spaces in this mutate filter? or should I use another filter block at the end?

5

I don't uderstand. The current configuration of gsub adding whitespaces but you want to remove it ?
If your goal is to change this
This+is+name%2+field
To this
This is name 2 fiel
The gsub already do the job.

6

I mean it adds a trailing space in some cases

7

Then yes, according to the documentation, strip filter "only works on leading and trailing whitespace".

1 Like
8

If you sometimes have

"This+is+name%2+field+"

the it would make more sense to do

mutate {
  gsub => [
    "field", "[+%]", " ",
    "field", "\s+$", ""
  ]
}

mutate+gsub does things in order.

2 Likes
9

Thank you! that's better.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.