logstash-plugins / logstash-filter-mutate

Apache License 2.0
16 stars 75 forks source link

mutate->gsub doesn't work on json extracted field with backslash #32

Closed jordansissel closed 9 years ago

jordansissel commented 9 years ago

(This issue was originally filed by @nellicus at https://github.com/elastic/logstash/issues/3238)


OK gsub replacing "\n" works on plain message field

abonuccelli@w530 /opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{mutate{gsub=>["message","\\n","newline"]}}output{stdout{codec=>rubydebug}}'
Logstash startup completed
\n
{
       "message" => "newline",
      "@version" => "1",
    "@timestamp" => "2015-05-13T10:09:34.542Z",
          "host" => "w530"
}

PROBLEM gsub replacing "\n" doesn't work on json field

abonuccelli@w530 /opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{json{source=>message}mutate{gsub=>["jsonfield","\\n","newline"]}}output{stdout{codec=>rubydebug}}' 
Logstash startup completed
{"jsonfield":"\n"}
{
       "message" => "{\"jsonfield\":\"\\n\"}",
      "@version" => "1",
    "@timestamp" => "2015-05-13T10:10:23.311Z",
          "host" => "w530",
     "jsonfield" => "\n"
}

note this seems something specific with replacing slashes in json - replacement in json field with no \ works

/opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{json{source=>message}mutate{gsub=>["jsonfield","apples","oranges"]}}output{stdout{codec=>rubydebug}}' 
Logstash startup completed
{"jsonfield":"apples"}
{
       "message" => "{\"jsonfield\":\"apples\"}",
      "@version" => "1",
    "@timestamp" => "2015-05-13T10:08:23.933Z",
          "host" => "w530",
     "jsonfield" => "oranges"
}
purbon commented 9 years ago

Closed in favor of #3265