Use Replace with regular expression to change case

Graylog Central (peer support)
1

I am attempting to use the extractor “Replace with regular expression” to change the case of a field from lowercase or mixed case to uppercase. I cannot figure out how to do this. What I have:

Regular Expression:"\s*([^"])\s"
Replacement:$1

In: "Error"
Out: Error

This is fine up until I want to change the case. I have tried \u$1, but that just outputs uError. Any ideas would be great.

2

With the extractor being based on the regular expressions functionality from the Java standard library (see Matcher#replaceAll(java.lang.String)), that’s not possible.

3

That’s what I was afraid of. Didn’t want to break into pipelines, but I guess I have to.

Thank you for replying.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.