Replace with regular expression in a rule instead of extractor

(Christoph Kirchner) #1

How can I use the “replace with regular expression” function in a rule?
The goal is to modify a string like {“user”:“madman”, “rule”:“madrule”} to {“user”:“madman”, “rule”:“madrule”} - so I can use the json functions to extract the values.
It can not be done in a stream extractor, because it shoud only applied on specific messages in some pipelines.