Page 1 of 1

replacing backslashes

Posted: Fri Aug 19, 2016 4:10 am
by _asp_
Hi, I have following stuff in a field:

"field_A" => "c:\\test\\test.txt"
rubydebug shows it as "c:\\\\test\\\\test.txt"

By some conversion the masking backslash became a valid character.
How can I get rid of the double backslashes, so that I have only one (or two when masked)?

I tried:

Code: Select all

mutate
{
  gsub =>
  [
    'field_A', '(\\\\)', '\\'
  ]
}
but that is not accepted by logstash.
If I try to replace to '[\\]' then the brackets are also inserted.

Any idea?
Thanks a lot.

Re: replacing backslashes

Posted: Fri Aug 19, 2016 7:24 am
by eloyd
Sorry, but this is broken within logstash itself: https://logstash.jira.com/browse/LOGSTASH-1377

Re: replacing backslashes

Posted: Fri Aug 19, 2016 11:48 am
by rkennedy
Thanks @eloyd! Unfortunately, this is the answer.

@_asp_ let us know if you have further questions regarding this.