My line to dissect begins with \e[92mContent , I need extract Content avoiding \e[92
I have already try:
dissect { mapping => { "message" => "\e[92m%{content}"}}
But not works
My line to dissect begins with \e[92mContent , I need extract Content avoiding \e[92
I have already try:
dissect { mapping => { "message" => "\e[92m%{content}"}}
But not works
Your message does not contain \e. What you have is a CSI (control sequence introductor), which starts with an escape character. rubydebug displays the escape character as \e. A UNIX editor typically displays an escape as ^[.
output { stdout { codec => rubydebug { metadata => false } } }
input { generator { count => 1 lines => [ '^[[92mFoo' ] } }
filter {
dissect { mapping => { "message" => "^[[92m%{content}"}}
}
will produce
"message" => "\e[92mFoo"
"content" => "Foo"
On UNIX you would enter a literal escape by typing ctrl/V and then escape
The king of the forum, related to this things.
Many thanks.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.