Logstash Dissect against \e control character

Elastic Stack Logstash
1

My line to dissect begins with \e[92mContent , I need extract Content avoiding \e[92

I have already try:

dissect { mapping => { "message" => "\e[92m%{content}"}}

But not works

2

Your message does not contain \e. What you have is a CSI (control sequence introductor), which starts with an escape character. rubydebug displays the escape character as \e. A UNIX editor typically displays an escape as ^[.

output { stdout { codec => rubydebug { metadata => false } } }
input { generator { count => 1 lines => [ '^[[92mFoo' ] } }
filter {
    dissect { mapping => { "message" => "^[[92m%{content}"}}
}

will produce

   "message" => "\e[92mFoo"
   "content" => "Foo"

On UNIX you would enter a literal escape by typing ctrl/V and then escape

3

The king of the forum, related to this things.
Many thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.