My gsub doesn't recognize predefined patterns. What am I missing?

Elastic Stack Logstash
1

I'm trying to do a string replace on every MONTH in my message, but when I run it nothing gets replaced:

            if "foo" in [tags] {
                    mutate {
                            gsub => [
                                    "message",
                                    "%{MONTH}",
                                    "FOOBARBAZ"
                            ]
                    }
            }

I manually plugged in the regular expression for the MONTH pattern and it works fine:

            if "foo" in [tags] {
                    mutate {
                            gsub => [
                                    "message",
                                    "\b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b",
                                    "FOOBARBAZ"
                            ]
                    }
            }

Clearly I'm missing something obvious. Problem is I don't know what!

2

gsub doesn't support grok patterns.

3

Well that's a huge letdown. My regular expression is like 80 lines when I pull in the patterns I need. Oh well.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.