Mutate gsub \ not working


I have a log

.... \"pattern\":\"^[0-9]{9}$\"},\"typeId\":{\"enum\":[32], \"mysensitivefield\":\"ASDASDLAASDASDASLDASDAZ\" 

, I need to replace mysensitivefield information.
getting like this ********** : ************

I am try

      mutate {
         gsub => [
           "message", "mysensitivefield([^;]+)\S+", "\1******************\2"

but not working , i believe that i need to replcate \ to "" .

someone had a problem trying to use some filter in \ ?

You only have one capture group there. What do you expect \2 to be replaced by?

That regex doesn't make much sense :face_with_raised_eyebrow:

If you want to look for
and transform it to

one way would be to capture the separators around the value and use them to create a new string with asterisks and the captured separators. There is a also some single/double-quote juggling so I'm not going to claim ownership of this configuration :see_no_evil:

         gsub => [ "message", '"mysensitivefield(\\\":\\\").*?(\\\")', '"****\1****\2'   ]

Great, Its works.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.