Using transforms and props to search and replace multiple fields in an event

[brettcave]

If I have an event that looks like this:

META1 META2 {foo:bar,color:green,size:medium} some text ({client: x, ip: z})

And I want to use a single transforms to replace the values for foo, color and size, to produce logs like:

META1 META2 {foo:###,color:###,size:###} some text ({client:x, ip:z})

I wanted to use the following in transforms, but it's only replacing the first field:

REGEX=(?m)(META.* {)(foo|color|size):\w(}.*)$
FORMAT=$1###$3

It only masks the first value, how would I match multiple values?

Sample log output

    META1 META2 {foo:###,color:green,size:medium some text ({client:x, ip:z})

[richgalloway · Accepted solution]

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

[brettcave]

thanks @richgalloway , am testing this now.

[richgalloway]

Still testing? If your problem is resolved, please accept the answer to help future readers.

[GindiKhangura]

@brettcave,

Legend has it that @richgalloway is still looking for that upvote.

[brettcave]

accepted answer.