Remove charactes with gstug

Elastic Stack Logstash
1

Hi all, I would need some help with mutate gsub filter.

I have something like

ArchivedCanonicalItemEvent CanonicalProductSalesAreaToCatalogMapping SAPCONFIGURATION_POOL 26472b62-8943-44a4-a88e-6dabee93d825 20_1001 098996f0-367b-3c75-afbb-f40653b744f12 79 1001_20B\bARCHIVED

CanonicalItemEvent CanonicalProductSalesAreaToCatalogMapping SAPCONFIGURATION_POOL c1036fbd-8a49-45f5-8787-5c2f9d389e71 20_1002 f15cc8bb-f1b0-37a1-834e-b1f26c0543db2 80 1002_20B\aSUCCESS

I need some help using a mutate filter to replace

B\bARCHIVED --> ARCHIVED
B\aSUCCESS --> SUCCESS

I've tried with

mutate {
gsub => [ "message", "B\bARCHIVED", "ARCHIVED"]
}

		mutate {
	gsub => [ "message", "B\aSUCCESS", "SUCCESS"]
}

But I get same result.

Any help?

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.