Hi,
I have an uri on nginx log like this: /xyz/attachment/thumbnail/61355754/90/90 and others, so I need to use gsub to replace all number to something else, /xyz/attachment/thumbnail/{}/{}/{} for example, I tried to use this configuration:
Remove number from uri and create a new field clean_uri
if [i_uri] {
mutate {
add_field => { "clean_uri" => "%{[i_uri]}"}
}
mutate {
gsub => ["[clean_uri]", "/\b\d+\b/", "/{}/"]
}
}
But the regex "/\b\d+\b/" is not replacing all, this replaces only the first group of numbers like this: /xyz/attachment/thumbnail/{}/90/90, how do I replace all, like a global regex.