I am sending below log file from filbeat to Logstash. The below is the output from filbeat to Logstash
\u001b[m\u001b[32m[2019-12-02T17:30:09,995] INFO - [http-nio-8080-exec-9:40] {client_ip=13.232.113.45, request_id=8D9383C6E4FD40EC90324627F8EF839C} [filter.RequestAndResponseLoggingFilter.doFilterInternal:113] Response body: {\"status\":\"success\",\"message\":\"success\"}"
I want to remove \u001b[m\u001b[32m
I added below setting in gsub for logstash but it still comes in Kibana
["message","^\\u001b\[m\\u001b\[32m"," "]
The code that I want to mutate is a color code used in tomcat to see info, error in tomcat logs
Unable to figure out color code , figured out a way around
mutate {
gsub => ["message", ".+?(?=\[[0-9]{4}-[0-9]{2}-[0-9]{2})", ""
}
Above GSUB mutate anything before Date. This resolved the issue