replacing backslashes

[_asp_]

Hi, I have following stuff in a field:

"field_A" => "c:\\test\\test.txt"
rubydebug shows it as "c:\\\\test\\\\test.txt"

By some conversion the masking backslash became a valid character.
How can I get rid of the double backslashes, so that I have only one (or two when masked)?

I tried:

Code: Select all

mutate
{
  gsub =>
  [
    'field_A', '(\\\\)', '\\'
  ]
}

but that is not accepted by logstash.
If I try to replace to '[\\]' then the brackets are also inserted.

Any idea?
Thanks a lot.

[eloyd]

Sorry, but this is broken within logstash itself: https://logstash.jira.com/browse/LOGSTASH-1377

[rkennedy]

Thanks @eloyd! Unfortunately, this is the answer.

@_asp_ let us know if you have further questions regarding this.