Replace

The Replace function operates on strings and employs regular expressions for matching. When a match occurs the matched value is replaced with a specified replacement value. The value may be a literal or a template which references named capture groups.

Usage

• Operates On: Field values
• Supported Field Types: string
• Label: Optional
• Filter: Optional

Required Configuration

• Field Name: The field name to operate on. May be of type string, map, or array. For maps all child field values of type string are considered. For an array all array values of type string are considered.
• Expression: A Go regular expression, may contain capture groups.
• Replacement Value: string literal or a golang string template referencing named capture groups.

Example

Match tags named svc_name in a Datadog log message tag set and replace tag name svc_name with service_name.

Configuration

• Field Name: ddtags
• Expression: (?P<svcname>svc_name):(?P<service>.*)
• Replacement Value: service_name:${service}

Before

{
  "ddtags": "svc_name:zookeeper,host:localhost,container_id:46f98894b4a5",
  "message": "1.1.1.2 access.log - [11/June/2023:03:04:55 +0100]  \"GET /\"  200 83"
}

After

{
  "ddtags": "service_name:zookeeper,host:localhost,container_id:46f98894b4a5",
  "message": "1.1.1.2 access.log - [11/June/2023:03:04:55 +0100]  \"GET /\"  200 83"
}