Logstash mutate gsub replace json key

[Suhee_Kim]

Hi,

I have been trying to replace '-' to '_'
like this,
{ "hello-world" : "something" } -> { "hello_world" : "something" }

this is my setting for logstash

input {
stdin {
codec => json
}
}

filter {
json { source => "message" }
mutate { gsub => ["message", "-", "_"] }
}

output {
stdout {
codec => rubydebug {}
}
}

how can i change it?
Please help me..

Thank you

[sjabiulla (JB)]

Hi @Suhee_Kim
Since you have used codec => json in stdin, by the time you reach filter your message is already converted to json fields. Hence message field is not available.

Below conf should replace '-' to '_' .

input {
    stdin {
    }
}

filter {
    mutate { gsub => ["message", "-", "_"] }
    json { 
        source => "message"
        remove_field => [ "message" ]
    }
}

output {
    stdout {
    codec => rubydebug {}
    }
}