Replaces each substring of the specified fields value that matches the given regular expression with the given replacement. LogScale uses JitRex which closely follows the syntax of re2j regular expressions, which has a syntax very close to Java's regular expressions. Check out the syntax.

ParameterTypeRequiredDefaultDescription
asstringfalse Specifies the field to store the replaced string as. Default is replacing the contents of the input field .
fieldstringfalse@rawstringSpecifies the field to run the replacement on. Default is running against @rawstring. [a]
flagsstringfalsemSpecifies other regex flags.
  Valid ValuesdPeriod (.) includes newline characters
   iIgnore case for matched values
   mMulti-line parsing of regular expressions
regexstringtrue The regular expression to match.
replacementstringfalse The string to substitute for each match (same as with).
withstringfalse The string to substitute for each match (defaults to a pair of double-quotes).

[a] When you provide only one parameter, the implied parameter is field

Examples

  • Correct a spelling mistake

    logscale
    replace(regex=properties, with=properties)

  • Get the integer part of a number. This example uses regex capturing groups, and stores the replacement in the field b, leaving field a untouched. This is the same as regex("(?<b>\d+)\..*", field=a) using a named capture group.

    logscale
    replace("(\d+)\..*", with="$1", field=a, as=b)

  • Truncate a message to 100 characters:

    logscale
    replace("^(.{100}).*", with="$1", field=message, as="truncated_message")