logstash
logstash copied to clipboard
[docs] add gsub reference example
Right now in https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub , gsub show only how to replace strings directly, but it is useful and supported to use regexp references. We either have to guess or search the web, as the documentation fail to mention this.
So please add one example in the gsub entry on how to use the regex reference, like:
mutate {
gsub => ["status","status=(\d+);", "\1"]
}
Maybe some more example when working on special characters. Like if you wanna replace something with a double quote, you might need a single quote instead.
mutate{
gsub => ["message", ':"', '="']
}