Replace middle of string

Hi All ,

Have question about how to gsub or replace some of middle string

The orginal body like this
A=somestinghere1&B=somestringhere2&C=somestringhere3&D=somestringhere4

What i would like to do like remain A,C and D
A=somestinghere1&B=Replace_ByELK&C=somestringhere3&D=somestringhere4

I try below but no luck , i will erase all wording after B=Replace_ByELK until the end of &

A=somestinghere1&B=Replace_ByELK&D=somestringhere4

if '&B=' in [body] {
mutate {
gsub => [ '[body]','&B=.*&','&B=Replace_ByELK&' ]
}
}
}

I suggest &B=[^&]+, i.e. "&B" followed by one or more characters of any kind except "&".

Works fine , thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.