Replace middle of string

(VincentNgai86) #1

Hi All ,

Have question about how to gsub or replace some of middle string

The orginal body like this

What i would like to do like remain A,C and D

I try below but no luck , i will erase all wording after B=Replace_ByELK until the end of &


if '&B=' in [body] {
mutate {
gsub => [ '[body]','&B=.*&','&B=Replace_ByELK&' ]

(Magnus B├Ąck) #2

I suggest &B=[^&]+, i.e. "&B" followed by one or more characters of any kind except "&".

(VincentNgai86) #3

Works fine , thanks

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.