Remove character pattern from field value

[bcarr12]

In one of my logs, I have some fields that return values such as:
status=FA-Full Pulse AOV Access Realm)[
status=FA-Full Pulse AOV Access Realm)[FA-CGK Bypass Role
status=unknown)[

What is the best way to strip the ")[" pattern from each of these values and replace with something like a blank space (ie " "). I tried replace ")[" WITH " " IN status but it doesn't seem to be doing anything.

[richgalloway · Accepted solution]

Replace should work, but perhaps it's confused by the paren and bracket. Try rex. It will be confused by the paren and bracket so they'll need to be escaped.

rex mode=sed "s/\)\[/ /g"

[bcarr12]

Thanks! This works great.

[bcarr12]

If I can be a pain - can rex also be used if I wanted to replace the )[ with something like a pipe? Just trying to find an easy way to seperate the values when there is more than one status.

For instance:
status=FA-Full Pulse AOV Access Realm |
status=FA-Full Pulse AOV Access Realm | FA-CGK Bypass Role
status=unknown |

[lguinn2]

If you want to permanently remove these characters, that can be done at parsing time.

props.conf

[yoursourcetypehere]
TRANSFORMS=fixChar

transforms.conf

[fixChar]
SOURCE_KEY=_raw
REGEX=(.*)\)\[(.*)
DEST_KEY=_raw
FORMAT=$1 $2

You might not want to set this up exactly as I have shown in this example, but it will probably work. Remember that you can't use the status field in the transform, because it doesn't exist at this point.