Logstash: gsub doesn't like regex expressing single backslash

[nellicus]

I want to replace a single backslash and using valid regex "\" to do so.

gsub doesn't like this

./bin/logstash -e 'input{stdin{}}filter{mutate{gsub=>["message","\\",""]}}output{stdout{codec=>rubydebug}}'
Error: Expected one of #, {, ,, ] at line 1, column 52 (byte 52) after filter{mutate{gsub=>["message","\\","

seems like I need to work this bug around with

 /opt/elk/TEST/logstash-1.5.0-rc3 $ ./bin/logstash -e 'input{stdin{}}filter{mutate{gsub=>["message","[\\]{1}","____"]}}output{stdout{codec=>rubydebug}}'
Logstash startup completed
\
{
       "message" => "____",
      "@version" => "1",
    "@timestamp" => "2015-05-13T10:36:20.860Z",
          "host" => "w530"
}

[ph]

also present in 1.4.2

~/e/s/logstash-1.4.2 ❯❯❯ ./bin/logstash -e 'input{stdin{}}filter{mutate{gsub=>["message","\\",""]}}output{stdout{codec=>rubydebug}}'
Error: Expected one of #, {, ,, ] at line 1, column 52 (byte 52) after filter{mutate{gsub=>["message","\\","
You may be interested in the '--configtest' flag which you can
use to validate logstash's configuration before you choose
to restart a running system.

[purbon]

Most probably related to #3238

[ESamir]

the fix for 3238 did not fix this issue and the work around is not working when using the fix

filter {

json {
    source => message
    remove_field => message
  } 


mutate {
  gsub => ["logmessage", "\\r", ""]
}
mutate {
  gsub => ["logmessage", "\\n", ""]
}

mutate{
gsub => ["logmessage","[\\]{1}",""]
}


  xml {
    source => "logmessage"    
 }
}

when I use the workaround I get this error

  premature end of char-class: /[\]{1}/

[purbon]

This is a known issue already reported at #1645, closing this in favor of him.

[gmoskovicz]

The following mutate filter should work, however this is a workaround:

mutate {
  gsub => ["message", "[\\]", ""]
}

[cameronkerrnz]

This is giving me a useful workaround to this problem. I'm wanting to fix up "DOMAIN\\\\user" to "DOMAIN\\user"

        mutate
        {
            gsub => ["username", "([\\])[\\]", "\1"]
        }