Hello,
I have been trying to strip the color codes out of my logs so that I can more easily use logstash but I have been unable to actually get it to work.
I found a comment and a small article that had a mutate string listed (works with sed just fine) but I cannot get it to work, has anyone been able to get that working?
Here is a little copy paste of the issue
filter {
if [type] == "testlog" {
mutate {
gsub => [ "message", "\r", "" ]
}
mutate {
gsub => [ "message", "\x1B[([0-9]{1,3}((;[0-9]{1,3})*)?)?[m|K]", "" ]
}
grok {
match => [
"message", "(?m)%{GREEDYDATA:rawdata}"
]
}
date {
match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
timezone => 'UTC'
}
}
}
output { stdout { codec => rubydebug } }
input - ^[[0;37m2016-02-16 07:05:03.435^[[0m [^[[0;37mDEBUG^[[0m]
output - "rawdata" => "^[[0;37m2016-02-16 07:04:29.208^[[0m [^[[32mINFO ^[[0m]
( I realize the lines are different but are just there as examples )