Remove contents of field from another field

Elastic Stack Logstash
1

Hello there,

I need to remove the contents of some field from another field.
This seems like an easy procedure, but sadly I couldn't get it to work.
This is what I tried, but it didn't work:

mutate {
gsub => ["message", [removethis], ""]
}

:arrow_right: Replace all the things in "message" matching with the contents of field "removethis" with "".

Essentially what I am looking for is something that can do this:

Field [message] = "Hello, I am Bob"
Field [removethis] = "Bob"

*** FILTER MAGIC ***

Field [message] after filter= "Hello, I am "

I hope you can help me. :sunglasses:

2

Have you tried

gsub => ["message", "%{removethis}", ""]

?

1 Like
3

Yep, that's it.
Thank you!
Sometimes it's that simple :grin:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.