Introduce tab in a message field



I need to reconstruct a field and want to introduce a horizontal tab (\t, 0x09).
Within the filter part I set the following

mutate {
replace => { "message" => "hello\tWorld" }

But this is not working. As an output i'm using tcp and the message field in as follow "message" => "HellobackslashbackslashtWorld"

Anyone an idea?

(Pablo) #2


you could use the event API?

event.get and then event.set

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.