Replace the value of a field

[wedkarz014 (Patryk)]

Hi,
I'm trying to add a few characters at the beginning and the end of a field but i have an error.
This is what i'd like to add " { "info": " and "}"
I tried:

   mutate {
        replace => { "message" => "{\"info\":%{message}}" }
      }

   mutate {
        replace => { "message" => "\{\"info\":%{message}\}" }
      }

   mutate { add_field => {"beginning "=>"{\"info\":" } }
   mutate { replace => { "message" =>" "%{beginning}  %{message}"} }

Can you help me?

[Badger]

I would use mutate+gsub

 mutate { gsub => [ "message", "^", '{ "info": ', "message", "$", "}" ] }

[wedkarz014 (Patryk)]

This is a multiline message so your proposition is incorrect - we have new text in each line.
But it works:

   mutate {
        replace => { "message" => '{"info":%{message}}' }
      }