Closed jordansissel closed 9 years ago
(This issue was originally filed by @nellicus at https://github.com/elastic/logstash/issues/3238)
OK gsub replacing "\n" works on plain message field
abonuccelli@w530 /opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{mutate{gsub=>["message","\\n","newline"]}}output{stdout{codec=>rubydebug}}' Logstash startup completed \n { "message" => "newline", "@version" => "1", "@timestamp" => "2015-05-13T10:09:34.542Z", "host" => "w530" }
PROBLEM gsub replacing "\n" doesn't work on json field
abonuccelli@w530 /opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{json{source=>message}mutate{gsub=>["jsonfield","\\n","newline"]}}output{stdout{codec=>rubydebug}}' Logstash startup completed {"jsonfield":"\n"} { "message" => "{\"jsonfield\":\"\\n\"}", "@version" => "1", "@timestamp" => "2015-05-13T10:10:23.311Z", "host" => "w530", "jsonfield" => "\n" }
note this seems something specific with replacing slashes in json - replacement in json field with no \ works
/opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{json{source=>message}mutate{gsub=>["jsonfield","apples","oranges"]}}output{stdout{codec=>rubydebug}}' Logstash startup completed {"jsonfield":"apples"} { "message" => "{\"jsonfield\":\"apples\"}", "@version" => "1", "@timestamp" => "2015-05-13T10:08:23.933Z", "host" => "w530", "jsonfield" => "oranges" }
Closed in favor of #3265
(This issue was originally filed by @nellicus at https://github.com/elastic/logstash/issues/3238)
OK gsub replacing "\n" works on plain message field
PROBLEM gsub replacing "\n" doesn't work on json field
note this seems something specific with replacing slashes in json - replacement in json field with no \ works