0

i'm trying to add a single character at the beginning of field content in logstash. I found on web only how to add it at the end using gsub plugin, like this:

dissect {
        mapping => {"message" => "%{message}<%{payload}"}
      }
      mutate {
        gsub => ["payload", "$", "<"]
      }

but if I would to add "<" at the beginning, how can i do it?

Luca M.
  • 13
  • 4

1 Answers1

1

The filter in your question uses a regex to find where to place the <. With $, it's matching the end of the string

mutate {
   gsub => ["payload", "$", "<"]
}

The regex to find the start of the string is ^. So you'll have to modify your filter like this:

mutate {
   gsub => ["payload", "^", "<"]
}

If you want to only add the < when it's not present:

mutate {
   gsub => ["payload", "^", "^(?!<)"]
}

Here the (?!<) part of the regex checks if the < is not present (negative lookahead); if there's already one, the regex won't match and no < get added.

baudsp
  • 4,076
  • 1
  • 17
  • 35
  • and if i wanted to put "<" only if it doesn't exist at beginning is possible? – Luca M. Jul 21 '21 at 09:28
  • Thank you, you're an angel. Is there a website where to find this regex? – Luca M. Jul 21 '21 at 09:45
  • I added a link to the question where I found the regex syntax (I knew it existed, but not the exact syntax). When working with regex, I usually use regex101.com to test them (for example [here](https://regex101.com/r/U8Sc0x/1) what I used in your case). – baudsp Jul 21 '21 at 09:48