Search code examples
elasticsearchlogstashkibanafilebeat

How can i add a character at the beginning of a field content?

i'm trying to add a single character at the beginning of field content in logstash. I found on web only how to add it at the end using gsub plugin, like this:

dissect {
        mapping => {"message" => "%{message}<%{payload}"}
      }
      mutate {
        gsub => ["payload", "$", "<"]
      }

but if I would to add "<" at the beginning, how can i do it?

Solution

  • The filter in your question uses a regex to find where to place the <. With $, it's matching the end of the string

    mutate {
   gsub => ["payload", "$", "<"]
}

    The regex to find the start of the string is ^. So you'll have to modify your filter like this:

    mutate {
   gsub => ["payload", "^", "<"]
}

    If you want to only add the < when it's not present:

    mutate {
   gsub => ["payload", "^", "^(?!<)"]
}

    Here the (?!<) part of the regex checks if the < is not present (negative lookahead); if there's already one, the regex won't match and no < get added.