How to remove only one character from string using GSUB?

Elastic Stack Logstash
1

Ok, so the issue I have is I want to remove a character once from a field value, and this specific character that I want to remove appears multiple times in the field value. I don't want to remove this character from all it's occurences in the field value, I just want to remove it once.

Example:
String: Boom,.lfoel.dk.ksjkd;'.s87.^5..
Remove the first "." only, leave the rest alone

Thanks in advance fellow Loggers,

2

You can't do this with gsub. Your best bet is a ruby filter or a grok filter. The latter could match everything up to the first occurrence of the character, then the character itself, then the rest. Afterwards you could string together the two pieces you captured.

1 Like
3

Thanks Magnus! Your awesome!