Mutate gsub \ not working

[Rafael_Pereira_Silva]

Hello,

I have a log

.... \"pattern\":\"^[0-9]{9}$\"},\"typeId\":{\"enum\":[32], \"mysensitivefield\":\"ASDASDLAASDASDASLDASDAZ\" 

, I need to replace mysensitivefield information.
getting like this ********** : ************

I am try

      mutate {
         gsub => [
           "message", "mysensitivefield([^;]+)\S+", "\1******************\2"
           ]
        }

but not working , i believe that i need to replcate \ to "" .

someone had a problem trying to use some filter in \ ?

[Badger]

You only have one capture group there. What do you expect \2 to be replaced by?

[andres-perez (Andrés Pérez)]

That regex doesn't make much sense

If you want to look for
\"mysensitivefield\":\"ASDASDLAASDASDASLDASDAZ\"
and transform it to
\"****\":\"****\"

one way would be to capture the separators around the value and use them to create a new string with asterisks and the captured separators. There is a also some single/double-quote juggling so I'm not going to claim ownership of this configuration

         gsub => [ "message", '"mysensitivefield(\\\":\\\").*?(\\\")', '"****\1****\2'   ]

[Rafael_Pereira_Silva]

Great, Its works.

Thanks