Logstash Dissect against \e control character

My line to dissect begins with \e[92mContent , I need extract Content avoiding \e[92

I have already try:

dissect { mapping => { "message" => "\e[92m%{content}"}}

But not works

Your message does not contain \e. What you have is a CSI (control sequence introductor), which starts with an escape character. rubydebug displays the escape character as \e. A UNIX editor typically displays an escape as ^[.

output { stdout { codec => rubydebug { metadata => false } } }
input { generator { count => 1 lines => [ '^[[92mFoo' ] } }
filter {
    dissect { mapping => { "message" => "^[[92m%{content}"}}

will produce

   "message" => "\e[92mFoo"
   "content" => "Foo"

On UNIX you would enter a literal escape by typing ctrl/V and then escape

The king of the forum, related to this things.
Many thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.