Mutate gsub Email Address

Elastic Stack Logstash
1

Hello guys,

I'm using ELK for 2 days now, to parse a CSV and see it in Kibana. My doubt is about mutate.

I have a field with a email address I can easily do this:

mutate{
gsub=> ["col2",".*@","@"]
}

In this case I replace what is after @ (including @) with @, so the email remains something like this @gmail.com

But this is for a column that only has a email address, I've been testing for a column that contains a sentence and a email, for instance:

'My name is xxx and my email is xxx@gmail.com'

What I'm looking for, is to replace xxx@ by @. Can anyone help?

Thanks in advanced

2

Actually just done it, after more than 20 tries.

I recommend this to find @ in a sentence:

mutate{
gsub => ["col2","(\W|^)[\w.+-]{0,100}@"," @"]
}

It finds the @ and what is before until the first space is found then it replace for @

Hope it helps, if anyone has a better solution, feel free to share!

Cheers

1 Like