How to replace 'special characters' with a logstash filter

Elastic Stack Logstash
2

It seems like logstash has some issues, when it comes to escaping things. See:

https://logstash.jira.com/browse/LOGSTASH-1377

and

for more information.

According to: https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub the following should replace backslashes, question marks, hashes and minuses:

filter {
  mutate {
    gsub => [
      # replace backslashes, question marks, hashes, and minuses
      # with a dot "."
      "fieldname2", "[\\?#-]", "."
    ]
  }
}

Maybe it works, if you use "[\]" ?

1 Like