From 2893ac46d27a2c7ac0c98dbc8c600a0903d8a3e1 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Tue, 13 Apr 2021 18:06:52 -0400 Subject: [PATCH 1/6] Update replace.asciidoc --- libbeat/processors/actions/docs/replace.asciidoc | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/libbeat/processors/actions/docs/replace.asciidoc b/libbeat/processors/actions/docs/replace.asciidoc index b833e2e84bb..69b2e8adc3d 100644 --- a/libbeat/processors/actions/docs/replace.asciidoc +++ b/libbeat/processors/actions/docs/replace.asciidoc @@ -11,15 +11,15 @@ contains a `field: field-name`, `pattern: regex-pattern` and `replacement: replacement-string`, where: * `field` is the original field name -* `pattern` is regex pattern to match field's value -* `replacement` is the replacement string to use for updating the field's value +* `pattern` is the regex pattern to match the field's value +* `replacement` is the replacement string to use to update the field's value The `replace` processor cannot be used to replace value with a completely new value. -TIP: You can replace field value to truncate part of field value or replace +TIP: Replace the field value to truncate part of the field value or replace it with a new string. It can also be used for masking PII information. -Following example will change path from /usr/bin to /usr/local/bin +The following example will change path from /usr/bin to /usr/local/bin: [source,yaml] ------- @@ -35,11 +35,11 @@ processors: The `replace` processor has following configuration settings: -`ignore_missing`:: (Optional) If set to true, no error is logged in case a specifiedfield +`ignore_missing`:: (Optional) If set to `true`, no error is logged in case a specified field is missing. Default is `false`. -`fail_on_error`:: (Optional) If set to true, in case of an error the replacement of -field values is stopped and the original event is returned. If set to false, replacement +`fail_on_error`:: (Optional) If set to `true`, in case of an error the replacement of +field values is stopped and the original event is returned. If set to `false`, replacement continues even if an error occurs during replacement. Default is `true`. See <> for a list of supported conditions. From b10ef6cdc2bdbb12bb428cd897be6881da27d019 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:19:48 -0400 Subject: [PATCH 2/6] Update libbeat/processors/actions/docs/replace.asciidoc Co-authored-by: Brandon Morelli --- libbeat/processors/actions/docs/replace.asciidoc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libbeat/processors/actions/docs/replace.asciidoc b/libbeat/processors/actions/docs/replace.asciidoc index 69b2e8adc3d..3acf5e506bd 100644 --- a/libbeat/processors/actions/docs/replace.asciidoc +++ b/libbeat/processors/actions/docs/replace.asciidoc @@ -16,8 +16,7 @@ contains a `field: field-name`, `pattern: regex-pattern` and The `replace` processor cannot be used to replace value with a completely new value. -TIP: Replace the field value to truncate part of the field value or replace -it with a new string. It can also be used for masking PII information. +TIP: The `replacement` field value can be used to truncate the `field` value or replace The following example will change path from /usr/bin to /usr/local/bin: @@ -46,4 +45,3 @@ See <> for a list of supported conditions. You can specify multiple `ignore_missing` processors under the `processors` section. - From 3ab278d7543f04b8adc07d754dfa84dbd7875f8f Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:20:13 -0400 Subject: [PATCH 3/6] Update libbeat/processors/actions/docs/replace.asciidoc Co-authored-by: Brandon Morelli --- libbeat/processors/actions/docs/replace.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/processors/actions/docs/replace.asciidoc b/libbeat/processors/actions/docs/replace.asciidoc index 3acf5e506bd..3a913926923 100644 --- a/libbeat/processors/actions/docs/replace.asciidoc +++ b/libbeat/processors/actions/docs/replace.asciidoc @@ -34,7 +34,7 @@ processors: The `replace` processor has following configuration settings: -`ignore_missing`:: (Optional) If set to `true`, no error is logged in case a specified field +`ignore_missing`:: (Optional) If set to `true`, no error is logged if the specified field is missing. Default is `false`. `fail_on_error`:: (Optional) If set to `true`, in case of an error the replacement of From 204134062891ced7fb3a7912183f0918ec1ca7b3 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:20:21 -0400 Subject: [PATCH 4/6] Update libbeat/processors/actions/docs/replace.asciidoc Co-authored-by: Brandon Morelli --- libbeat/processors/actions/docs/replace.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/processors/actions/docs/replace.asciidoc b/libbeat/processors/actions/docs/replace.asciidoc index 3a913926923..6087d0a30d1 100644 --- a/libbeat/processors/actions/docs/replace.asciidoc +++ b/libbeat/processors/actions/docs/replace.asciidoc @@ -37,7 +37,7 @@ The `replace` processor has following configuration settings: `ignore_missing`:: (Optional) If set to `true`, no error is logged if the specified field is missing. Default is `false`. -`fail_on_error`:: (Optional) If set to `true`, in case of an error the replacement of +`fail_on_error`:: (Optional) If set to `true` and there's an error, the replacement of field values is stopped and the original event is returned. If set to `false`, replacement continues even if an error occurs during replacement. Default is `true`. From e59546de8ae11dd7cd7879fe201e8b09dd7c1036 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:23:21 -0400 Subject: [PATCH 5/6] Update replace.asciidoc Accepted changes and fixed the "default sentences" to match what we have in other articles. --- libbeat/processors/actions/docs/replace.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libbeat/processors/actions/docs/replace.asciidoc b/libbeat/processors/actions/docs/replace.asciidoc index 6087d0a30d1..3920f7ec2fb 100644 --- a/libbeat/processors/actions/docs/replace.asciidoc +++ b/libbeat/processors/actions/docs/replace.asciidoc @@ -35,11 +35,11 @@ processors: The `replace` processor has following configuration settings: `ignore_missing`:: (Optional) If set to `true`, no error is logged if the specified field -is missing. Default is `false`. +is missing. The default is `false`. `fail_on_error`:: (Optional) If set to `true` and there's an error, the replacement of field values is stopped and the original event is returned. If set to `false`, replacement -continues even if an error occurs during replacement. Default is `true`. +continues even if an error occurs during replacement. The default is `true`. See <> for a list of supported conditions. From 43533935f5cf1f9bddcdd5fffef4da8932acf843 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Tue, 20 Apr 2021 12:25:51 -0700 Subject: [PATCH 6/6] Update libbeat/processors/actions/docs/replace.asciidoc --- libbeat/processors/actions/docs/replace.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/libbeat/processors/actions/docs/replace.asciidoc b/libbeat/processors/actions/docs/replace.asciidoc index 3920f7ec2fb..2ad206b8e12 100644 --- a/libbeat/processors/actions/docs/replace.asciidoc +++ b/libbeat/processors/actions/docs/replace.asciidoc @@ -17,6 +17,7 @@ contains a `field: field-name`, `pattern: regex-pattern` and The `replace` processor cannot be used to replace value with a completely new value. TIP: The `replacement` field value can be used to truncate the `field` value or replace +it with a new string. It can also be used for masking PII information. The following example will change path from /usr/bin to /usr/local/bin: