Add mutate examples to example pillar file

[ninapavlich]

It's hard (for me at least) to see how I would go about mutating a field using the pillar field.

Examples of field mutation in the output json are shown here in the Logstash Config examples: https://www.elastic.co/guide/en/logstash/current/config-examples.html

Would it be possible for you to add a very basic usage example to the example pillar file in this repo for reference?

[absmith82]

attempting to mutate as well and this is not working, using the gsub filter of the mutate plugin through pillar.

here is the current config in pillar

-
  plugin_name: mutate
  cond: 'if "netlog" in [tags]'
  gsub: '["message","\/","_"]'
-
  plugin_name: mutate
  cond: 'if "netlog" in [tags]'
  gsub: '["message","unknown-0","unknown"]'
-
  plugin_name: mutate
  cond: 'if "netlog" in [tags]'
  gsub: '[message","\+","_"]'

this is the output

if "netlog" in [tags] {
    mutate {
        gsub => "["message","\/","_"]"  
    }
}
if "netlog" in [tags] {
    mutate {
        gsub => "["message","unknown-0","unknown"]"  
    }
}
if "netlog" in [tags] {
    mutate {
        gsub => "[message","\+","_"]"  
    }
}

the output should look like this

if "netlog" in [tags] {
    mutate {
        gsub => {
           [" message", "\/", "_"]
        }  
    }
}
if "netlog" in [tags] {
    mutate {
        gsub => {
            ["message" ,"unknown-0" , "unknown"]
        }  
    }
}
if "netlog" in [tags] {
    mutate {
        gsub => {
            ["message","\+" , "_"]
        }  
    }
}

if I do this

-
  plugin_name: mutate
  cond: 'if "netlog" in [tags]'
  gsub: 
    message: "\/","_"

the output looks like this

if "netlog" in [tags] {
    mutate {
        gsub {
          message=> ""\/","_""  
    }
}

[absmith82]

Ok I got this one figured out, hope this works for others as well

pillar

logstash: 
  filters:
    -
      plugin_name: mutate
      cond: 'if "netlog" in [tags]'
      gsub: 
        - "message" 
        - "\\/" 
        - "_"

output

if "netlog" in [tags] {
    mutate {
        gsub => [
          "message",
          "\/",
          "_"
        ]   
    }
}

notice there needs to be a secondary escape character before the desired escape character in the pillar. Without this it will throw an error and your pillar will not populate for that section

I will get this added into the pillar example.

[absmith82]

added PR #31 to address this issue