If I have an event that looks like this:
META1 META2 {foo:bar,color:green,size:medium} some text ({client: x, ip: z})
And I want to use a single transforms to replace the values for foo
, color
and size
, to produce logs like:
META1 META2 {foo:###,color:###,size:###} some text ({client:x, ip:z})
I wanted to use the following in transforms, but it's only replacing the first field:
REGEX=(?m)(META.* {)(foo|color|size):\w(}.*)$
FORMAT=$1###$3
It only masks the first value, how would I match multiple values?
Sample log output
META1 META2 {foo:###,color:green,size:medium some text ({client:x, ip:z})
Try adding REPEAT_MATCH = true
to the transforms.conf stanza.
Try adding REPEAT_MATCH = true
to the transforms.conf stanza.
thanks @richgalloway , am testing this now.
Still testing? If your problem is resolved, please accept the answer to help future readers.
Legend has it that @richgalloway is still looking for that upvote.
accepted answer.