Hi,
I was wondering if telegraf processor ‘Regex’ can replace regex matched string with blank or not, I try to leave replacement field blank, but seems not working, is there any way to do this?
Can you provide a sample line from your log that you wish the replacement to happen on?
Sorry for lack of information, I found a workaround solution.
The sample log is nginx access log, and I parse it by using input.tail:
But fields like ‘user’ and ‘referer’ might be ‘-’, I want to replace with empty string, so that the data collect by telegraf agent will be standardize, and it will help me easier to use this data for further parsing.
Unfortunately processor.regex replacement config cannot be set empty string (replacement = “”), and I need regex to full match ‘-’ (^-$), when processor.strings only support substring replacement, that means when referer value is ‘/test.action?xx=asd-fgh’, it will be ‘/test.action?xx=asdfgh’, that’s not I want.
The workaround I use is this:
[[processors.strings]]
namepass = [“test.log.*”]
[[processors.regex]]
[[processors.regex.fields]]
key = “referer”
pattern = “^-"
replacement = ""
[[processors.strings.trim_prefix]]
field = "referer"
prefix = "-"
[[processors.regex.fields]]
key = "user"
pattern = "^-”
replacement = “”
[[processors.strings.trim_prefix]]
field = “user”
prefix = “-”
- identify string only contian 1 ‘-’ through regex.
- because regex replacement not support empty string “”, use strings processor instead.
- use processor strings trim to eliminate ‘-’.
