Gsub processor

The gsub processor performs a regular expression search-and-replace operation on string fields in incoming documents. If the field contains an array of strings, the operation is applied to all elements in the array. However, if the field contains non-string values, the processor throws an exception. Use cases for the gsub processor include removing sensitive information from log messages or user-generated content, normalizing data formats or conventions (for example, converting date formats, removing special characters), and extracting or transforming substrings from field values for further processing or analysis.

The following is the syntax for the gsub processor:

  1. "gsub": {
  2.   "field": "field_name",
  3.   "pattern": "regex_pattern",
  4.   "replacement": "replacement_string"
  5. }

copy

Configuration parameters

The following table lists the required and optional parameters for the gsub processor.

ParameterRequired/OptionalDescription
fieldRequiredThe field to apply the replacement to.
patternRequiredThe pattern to be replaced.
replacementRequiredThe string that will replace the matching patterns.
target_fieldOptionalThe name of the field in which to store the parsed data. If target_field is not specified, the parsed data replaces the original data in the field field. Default is field.
ifOptionalA condition for running the processor.
ignore_missingOptionalSpecifies whether the processor should ignore documents that do not contain the specified field. Default is false.
ignore_failureOptionalSpecifies whether the processor continues execution even if it encounters an error. If set to true, then failures are ignored. Default is false.
on_failureOptionalA list of processors to run if the processor fails.
tagOptionalAn identifier tag for the processor. Useful for debugging in order to distinguish between processors of the same type.

Using the processor

Follow these steps to use the processor in a pipeline.

Step 1: Create a pipeline

The following query creates a pipeline named gsub_pipeline that uses the gsub processor to replace all occurrences of the word error with the word warning in the message field:

  1. PUT _ingest/pipeline/gsub_pipeline
  2. {
  3.   "description": "Replaces 'error' with 'warning' in the 'message' field",
  4.   "processors": [
  5.     {
  6.       "gsub": {
  7.         "field": "message",
  8.         "pattern": "error",
  9.         "replacement": "warning"
  10.       }
  11.     }
  12.   ]
  13. }

copy

Step 2 (Optional): Test the pipeline

It is recommended that you test your pipeline before you ingest documents.

To test the pipeline, run the following query:

  1. POST _ingest/pipeline/gsub_pipeline/_simulate
  2. {
  3.   "docs": [
  4.     {
  5.       "_source": {
  6.         "message": "This is an error message"
  7.       }
  8.     }
  9.   ]
  10. }

copy

Response

The following response confirms that the pipeline is working as expected:

  1. {
  2.   "docs": [
  3.     {
  4.       "doc": {
  5.         "_index": "_index",
  6.         "_id": "_id",
  7.         "_source": {
  8.           "message": "This is an warning message"
  9.         },
  10.         "_ingest": {
  11.           "timestamp": "2024-05-22T19:47:00.645687211Z"
  12.         }
  13.       }
  14.     }
  15.   ]
  16. }

copy

Step 3: Ingest a document

The following query ingests a document into an index named logs:

  1. PUT logs/_doc/1?pipeline=gsub_pipeline
  2. {
  3.   "message": "This is an error message"
  4. }

copy

Response

The following response shows that the request indexed the document into the index named logs and that the gsub processor replaced all occurrences of the word error with the word warning in the message field:

  1. {
  2.   "_index": "logs",
  3.   "_id": "1",
  4.   "_version": 1,
  5.   "result": "created",
  6.   "_shards": {
  7.     "total": 2,
  8.     "successful": 1,
  9.     "failed": 0
  10.   },
  11.   "_seq_no": 0,
  12.   "_primary_term": 1
  13. }

copy

Step 4 (Optional): Retrieve the document

To retrieve the document, run the following query:

  1. GET logs/_doc/1

copy

Response

The following response shows the document with the modified message field value:

  1. {
  2.   "_index": "logs",
  3.   "_id": "1",
  4.   "_version": 1,
  5.   "_seq_no": 0,
  6.   "_primary_term": 1,
  7.   "found": true,
  8.   "_source": {
  9.     "message": "This is an warning message"
  10.   }
  11. }

copy