将所有+替换为字段Logstash中的空格

Question

我想转向我的领域：

"device_model": "archos+Bush+7.0+MyTablet"

到

"device_model": "archos Bush 7.0 MyTablet"

Answer 1

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub

filter {
  mutate {
    gsub => [
      # replace all plusses with spaces
      "device_model", "\+", " "
    ]
  }
}