How to replace a pattern after specific character in logstash message-CodePudding

I have a message like this :

`The is my sample HMAC message`HMAC HMAC HMAC

I want to replace this to :

`The is my sample HMAC message`

I have tried below code but it replaces all occurrences of HMAC:

mutate {
                    gsub => [ "message", "HMAC", "" ]
                  }

I only want the pattern to be replaced after `. How can I achieve this in logstash using gsub?

CodePudding user response：

You can use grok.

filter {
  grok {
    match => { "message" => "`%{DATA:my_field_name}`" }
  }
}

the output will be:

{
  "my_field_name": "The is my sample HMAC message"
}

To test you can use kibana grok debugger (see screenshot) or you can use

EDIT: You can create a new field with quotes intact.

mutate {
    add_field => { "my_new_field" => "`%{[my_field_name]}`" }
}