Something is not OK. This conf is working fine. Can you test the same?
input {
generator {
"message" => "Syslog message: (unknown): Oct 20 12:55:51 (iamservera) **.**.*.**->/var/log/evtmgr_statuslog charon stat : ONLINE\n"
count => 1
}
} # input
filter {
mutate{ gsub => ["message", "[()]", ""] }
}
output {
stdout {
codec => rubydebug{ metadata => true}
}
}
Result:
{
"event" => {
"original" => "Syslog message: (unknown): Oct 20 12:55:51 (iamservera) **.**.*.**->/var/log/evtmgr_statuslog charon stat : ONLINE\\n"
},
"message" => "Syslog message: unknown: Oct 20 12:55:51 iamservera **.**.*.**->/var/log/evtmgr_statuslog charon stat : ONLINE\\n"
}