Replace
Descriptionâ
Examines string value in a given field and replaces substring of the string value that matches the given string literal or regexes with the given replacement.
tip
This transform ONLY supported by Spark.
Optionsâ
name | type | required | default value |
---|---|---|---|
source_field | string | no | raw_message |
fields | string | yes | - |
pattern | string | yes | - |
replacement | string | yes | - |
is_regex | boolean | no | false |
replace_first | boolean | no | false |
source_field [string]â
Source field, if not configured, the default is raw_message
field [string]â
The name of the field to replaced.
pattern [string]â
The string to match.
replacement [string]â
The replacement pattern (is_regex is true) or string literal (is_regex is false).
is_regex [boolean]â
Whether or not to interpret the pattern as a regex (true) or string literal (false).
replace_first [boolean]â
Whether or not to skip any matches beyond the first match.
common options [string]â
Transform plugin common parameters, please refer to Transform Plugin for details
Examplesâ
the word a
will be replaced by b
at message field values.
replace {
source_field = "message"
fields = "_replaced"
pattern = "a"
replacement = "b"
}
Use Replace
as udf in sql.
Replace {
fields = "_replaced"
pattern = "([^ ]*) ([^ ]*)"
replacement = "$2
isRegex = true
replaceFirst = true
}
# Use the split function (confirm that the fake table exists)
sql {
sql = "select * from (select raw_message, replace(raw_message) as info_row from fake) t1"
}