# Replace string within a pattern in ruby

**URL:** <https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232>\
**Category:** Logstash\
**Created:** [December 26, 2017, 4:19pm UTC](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232 "2017-12-26T16:19:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elk\_chaser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk_chaser/32/76982_2.png) [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\
**Post date:** [December 26, 2017, 4:19pm UTC](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232/1 "2017-12-26T16:19:34Z")

</div>

Trying to find out a way on how to replace a substring within nested curly brackets  
my input string in a single line:  
{"service": "service-2bc902c2", "report\_timestamp": "2017-12-18T12:58:32.545191", "service\_engine": "xyz-se-gdckc", "log\_id": 22681, "client\_ip": "1.8.7.111", "client\_src\_port": 556, "client\_dest\_port": 4403, "client\_rtt": 143, "ssl\_session\_id": "183728e1fb7778095c", "ssl\_version": "TLSv1.2", "ssl\_cipher": "RSA-AES256-GCM-SHA384", "http\_version": "1.1", "method": "GET", "uri\_path": "/test/service/atom/forms/catalog/owned", "uri\_query": "results=10&start=0&sortKey={its:" me\*}update\_date&sortOrder=desc&facet={id:tag,count": 30}&o.p60", "referer": "[https://test.abc.com/communities/service/html/ownedcommunities](https://test.abc.com/communities/service/html/ownedcommunities)", "user\_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36", "persistence\_used": 1, "host": "[w.test.com](http://w.test.com)", "persistent\_session\_id": 965981681, "pool": "vs\_ip": "1.16.14.26", "body\_updated": "NOT\_UPDATED", "vs\_name": "test\_g4\_4403"}

trying to replace string within nested {} such as {id:tag,count": 30} with colons, quotes removed within original input

I am using ruby to replace. so far tried this, but its not working

ruby block

ruby {  
code =\> "  
str = event.get('message')  
copy=str  
nested = str.scan(/(?={((?:[^{}]++|{\g\<1\>})++)})/)  
nested[1,nested.length-1].each {  
|longVariableName|  
replaced=longVariableName.to\_s.gsub(/:/,'').gsub(/\s+/,'').gsub(/"/,'').gsub(/\/,'')  
longVariableName=longVariableName.to\_s.gsub(/\"/,'abc').gsub(/"/,'').gsub(/abc/,'"').gsub(/\/,'')  
printf '\r\nreplacing %s with %s ' , longVariableName , replaced  
copy.gsub( /#{longVariableName}/ ,replaced)

```
}

```

printf ' The final string is %s' , copy  
event.set('message',str)  
"  
}  
Please help

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 31, 2017, 1:33pm UTC](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232/2 "2017-12-31T13:33:39Z")

</div>

Don't operate on the whole JSON string. Deserialize the JSON string into structured fields, then apply transformations.

I don't understand what you're trying to do. What, exactly, does the input look like right now? What would you like it to look like instead?

---

<div class="post-metadata">

**Author:** ![elk\_chaser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk_chaser/32/76982_2.png) [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\
**Post date:** [December 31, 2017, 2:52pm UTC](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232/3 "2017-12-31T14:52:01Z")

</div>

Hi Magnus,  
I have to operate on entire log line (which is not json structured yet) to make it structured json. I have some characters in the nested json like structure which is not right as per json structure, such as some double quotes, commas in the string which is not kv separator.  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 28, 2018, 2:52pm UTC](https://discuss.elastic.co/t/replace-string-within-a-pattern-in-ruby/113232/4 "2018-01-28T14:52:02Z")

</div>

Closed on January 28, 2018, 2:52pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.