Mutate gsub \ not working

Elastic Stack Logstash
1

Hello,

I have a log

.... \"pattern\":\"^[0-9]{9}$\"},\"typeId\":{\"enum\":[32], \"mysensitivefield\":\"ASDASDLAASDASDASLDASDAZ\"

, I need to replace mysensitivefield information.
getting like this ********** : ************

I am try

      mutate {
         gsub => [
           "message", "mysensitivefield([^;]+)\S+", "\1******************\2"
           ]
        }

but not working , i believe that i need to replcate \ to "" .

someone had a problem trying to use some filter in \ ?

2

You only have one capture group there. What do you expect \2 to be replaced by?

3

That regex doesn't make much sense :face_with_raised_eyebrow:

If you want to look for
\"mysensitivefield\":\"ASDASDLAASDASDASLDASDAZ\"
and transform it to
\"****\":\"****\"

one way would be to capture the separators around the value and use them to create a new string with asterisks and the captured separators. There is a also some single/double-quote juggling so I'm not going to claim ownership of this configuration :see_no_evil:

         gsub => [ "message", '"mysensitivefield(\\\":\\\").*?(\\\")', '"****\1****\2'   ]
6

Great, Its works.

Thanks

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.