Remove escape characters from Drive

Elastic Stack Beats
1

Hi, I'm monitoring some windows machines with metricbeat, the drives always have escape characters \ that handling in logstash, and in kibana rules is a nightmare, is there a good way to remove them? preferably directly in metricbeat

2

I found a way:

processors:
  - replace:
      fields:
        - field: "system.filesystem.mount_point"
          pattern: "\\\\"
          replacement: ""
      ignore_missing: false
      fail_on_error: true

one single \ needs to be espaced three times!

1 Like