Replace processor

The Replace processor replaces portions of a string field that match a regular expression with a replacement string.

To use the Replace processor:

Select Create → Create processor.
Select Replace from the Processor menu.
Set the Source Field to the field that contains the string you want to replace.
Set the Pattern to the regular expression or text that you want to replace.
Set the Replacement to the value that will replace the portion of the string matching your pattern. Replacements can be text, an empty value, or a capture group reference.

This functionality uses the Elasticsearch Gsub processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

YAML reference

In YAML mode, configure the replace processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter	Type	Required	Description
`from`	string	Yes	Source field containing the string.
`pattern`	string	Yes	Regular expression pattern to match (Java regex).
`replacement`	string	Yes	Replacement string. Supports capture group references (for example, `$1`, `$2`).
`to`	string	No	Target field for the result. Defaults to the source field.
`ignore_missing`	boolean	No	When `true`, skip this processor if the source field is missing.

		- action: replace
  from: attributes.email
  pattern: "(\\w+)@(\\w+\\.\\w+)"
  replacement: "***@$2"
		
	