How to replace all groups of number in a string using gsub

Hi,

I have an uri on nginx log like this: /xyz/attachment/thumbnail/61355754/90/90 and others, so I need to use gsub to replace all number to something else, /xyz/attachment/thumbnail/{}/{}/{} for example, I tried to use this configuration:

Remove number from uri and create a new field clean_uri

  if [i_uri] {
    mutate {
      add_field => { "clean_uri" => "%{[i_uri]}"}
    }
    mutate {
      gsub => ["[clean_uri]", "/\b\d+\b/", "/{}/"]
    }
  }

But the regex "/\b\d+\b/" is not replacing all, this replaces only the first group of numbers like this: /xyz/attachment/thumbnail/{}/90/90, how do I replace all, like a global regex.

The issue was solved using:

# Remove number from uri and create a new field clean-uri
          if [i_uri] {
            mutate {
              add_field => { "clean-uri" => "%{i_uri}"}
            }
            mutate {
              gsub => ["[clean-uri]", "(\b\d+\b)", "*"]
            }
          }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.