如何使用gsub将包含下划线的部分字符串转换为logstash中的括号

Question

I want to convert, for eg Hello_1_.Bye to Hello[1].Bye Note that [1], ie, within brackets contain only digits

I started with something like this that didn't work..

filter {
  mutate {
    gsub => ["String", "*_\D_.*", "*[\D].*"] //Note that String here could be Hello_1_.Bye, Hello_2_.Bye etc.
  }
 }

but getting this error

:exception=>#<RegexpError: target of repeat operator is not specified: /*_\D_*/>

Appreciate your help

Answer 1

I suggest using this version:

filter {
  mutate {
    gsub => ["Hello_1_.Bye", "([^_]+)_(\d+)_(\.\w+)", "\1[\2]\3"]
  }
}

Here is a regex demo showing that the replacement is working.