regexrubylogstashgsublogstash-filter

How to convert part of a string that includes underscores to brackets in logstash with gsub

I want to convert, for e.g. Hello_1_.Bye to Hello[1].Bye Note that [1], i.e., within brackets contain only digits

I started with something like this that didn't work..

filter {
  mutate {
    gsub => ["String", "*_\D_.*", "*[\D].*"] //Note that String here could be Hello_1_.Bye, Hello_2_.Bye etc.
  }
 }

but getting this error

:exception=>#<RegexpError: target of repeat operator is not specified: /*_\D_*/>

Appreciate your help

Solution

  • I suggest using this version:

    filter {
  mutate {
    gsub => ["Hello_1_.Bye", "([^_]+)_(\d+)_(\.\w+)", "\1[\2]\3"]
  }
}

    Here is a regex demo showing that the replacement is working.