Use filter mutate gsub emoticons (emoji) in unicode values

Elastic Stack Logstash
1

I would like to use mutate (gsub) on "text" fieldname to replace unicode value of emoticons to respective string values. An example -

"\ud83d\ude27" replaced by "emoticon_anguished"

I tried to escape single backslash by two, as following. Replacement is not working.

filter {
        mutate {
                gsub => [
                                "text", "\\ud83d\\udc7f",  " emoticon_imp ",
                                "text", "\\ud83d\\ude3e",  " emoticon_pouting_cat "
                ]
        }
}

Any help? thank you.

2

I think, I am able to solve it. Instead of using emoji's unicode, we need to simply use emoji itself. like the following.

    mutate {
            gsub => [
                                    "text", "👿", " emoticon_imp ",
                                    "text", "😾", " emoticon_pouting_cat "
                           ]
                  }
1 Like