@stephenb, thanks for your response. I saw that processor and though it looks awesome and would obviously do the trick in this particular case, we are stuck on an older version of Elasticsearch.
Our pipeline moves generally have to work for 7.17.x. Unfortunately, it will be a while before we could use the Registered domain processor.
That said, with the transforms we find ourselves doing, this is likely not going to be the only case where we want to substitute only a portion of a string while keeping the rest of it in place.
The gsub in Logstash allows for the back reference syntax, which we previously had used a few times prior to moving to the ingest pipelines for a majority of our transforms. Does the gsub for the ingest pipelines not have this capability or is something just wrong about my syntax?
I would have expected gsub syntax and capabilities between those two things to be the same, other than the yaml vs. json differences, but there may be more at play than I realize.