The mutate's gsub result is incorrect

Elastic Stack Logstash
1

Hello everyone!

Here is the code:
m_mkt="CUK45:cuk45_moonv2_ab4533fd85f7d55ce6a1a695fdfb9300;"
result:
CUK45=cuk45_moonv2_ab4533fd85f7d55ce6a1a695fdfb9300

However, the result is this.
CUK45 = CUK45:cuk45_moonv2_ab4533fd85f7d55ce6a1a695fdfb9300;

kv {
source => "url_params"
field_split => "&"
value_split => "="
allow_duplicate_values => false
target => "url_params_hash"
}

if [url_params_hash][m_mkt] !~ /^http/ {
mutate {
gsub => [ "[url_params_hash][m_mkt]", "CUK45:", "" ]
gsub => [ "[url_params_hash][m_mkt]", ";", ""]
rename => { "[url_params_hash][m_mkt]" => "[url_params_hash][CUK45]" }
}
}

I would like to receive your help.
Thank you!

2

Can you add a tag in the mutate field to see if your conditional statement is working?

3

I can.

rename => { "[url_params_hash][m_mkt]" => "[url_params_hash][CUK45]"
[url_params_hash][m_mkt] = "CUK45:cuk45_moonv2_ab4533fd85f7d55ce6a1a695fdfb9300;"
[url_params_hash] [CUK45] = "CUK45:cuk45_moonv2_ab4533fd85f7d55ce6a1a695fdfb9300;"

The data of the rename's [url_params_hash] [CUK45] is "CUK45 = CUK45: cuk45_moonv2_ab4533fd85f7d55ce6a1a695fdfb9300;"

4

So you added a tag to the conditional statement and it works OK? Have you tried escaping the colon in the gsub statement?

5

I did.

if [url_params_hash][m_mkt] !~ /^http/ {
mutate {
add_field => { "test" => "mutate" }
gsub => [ "[url_params_hash][m_mkt]", "CUK45:", "" ]
gsub => [ "[url_params_hash][m_mkt]", "/;", ""]
rename => { "[url_params_hash][m_mkt]" => "[url_params_hash][CUK45]" }
}
}

{
"_index": "order_20181130",
"test": "mutate",
"CUK45": "CUK45:cuk45_inblacks_46c3976034f67a76925f4dc729674b28;",
},
}

6

Can you try:

gsub => [ "[url_params_hash][m_mkt]", "CUK45\:", "" ]
7

Thank you!
The issue has been resolved.

I try:

gsub => [ "[url_params_hash][m_mkt]", "CUK45\:", "" ]
gsub => [ "[url_params_hash][m_mkt]", "\;", "" ]

8

What changed from the first one??

9

I changed rename to add_field and tried escaping

10

Excellent, so the escape worked! Glad you got it sorted :slight_smile: Please mark as solution if completed!

11

Thank you very much!!!! :+1:

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.