Document Regexp modifiers for gsub mutations

[jrgns]

Since the needle / pattern of the gsub mutation can only be a string, there's no way to set regexp modifiers like case insensitive and multiline on the regular expression. This limits the usability of the mutation.

This can be done in one of two ways:

1. With a gsub_modifiers option that will be applied to all the regular expressions
2. With a fourth value that's passed along with the field name, regular expression and replacement

Option 1:

filter { mutate {
gsub => [ "message", "/Hello.*We saw the following error/", ""]
gsub_modifiers => "m"
} }

Option 2:

filter { mutate {
gsub => [ "message", "/Hello.*We saw the following error/", "m", ""]
} }

[german23]

+1 - this feature would make many things easier

[yeroc]

+1 - just ran into this myself while trying to 'patch' some multi-line inputs.

[jordansissel]

there's no way to set regexp modifiers

You can do this in-line in your regexp:

filter {
  mutate {
    gsub => [ "myfield", "(?m)dot '.' will now match the line terminator", "whatever" ]
  }
}

The (?m) flag will set multiline (m) flag for the whole regexp. I'm sorry we don't document this :(

You can learn more, for now, here: http://www.geocities.jp/kosako3/oniguruma/doc/RE.txt

An excerpt from the above link:

7. Extended groups
...
  (?imx-imx)         option on/off
                         i: ignore case
                         m: multi-line (dot(.) match newline)
                         x: extended form
  (?imx-imx:subexp)  option on/off for subexp

Hope this helps :)

[yeroc]

Thanks, that helps! I had checked the standard JRuby Regexp.new() constructor args and it looked like a separate parameter was required not realizing that gsub() doesn't use the standard Ruby libraries.

So I guess this ticket needs to be changed to note that all that needs to change is the documentation...

[coffeepac]

does anyone have a copy of the link that @jordansissel provided? It appears to be dead now.

[breml]

Long time since the last commet, but if some one is still looking for the link to oniguruma regex.