Replace substring and concat rest

I have DNS Logs looks like


I want to remove all (...) and replace this with a dot "."
if (..) is in front or end of the string i want to remove it.

Any clever approach without doing that in more steps like first cut the values and then build a new field out of the substrings?

Something like this might work:

mutate {
  gsub => [
    "message", "(^\(\d*\))|(\(\d*\)$)", "",
    "message", "\(\d*\)", "."
1 Like

Great help, thanks Jenni .... again :wink:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.