From b3a53b2674e9892e29aa425975814d6527763975 Mon Sep 17 00:00:00 2001
From: Ashley Jeffs <ash@jeffail.uk>
Date: Fri, 15 Nov 2019 10:13:47 +0000
Subject: [PATCH] Update changelog

---
 CHANGELOG.md              |  4 ++++
 docs/processors/README.md | 33 ++++++++++++++++++++++++++++++---
 lib/processor/text.go     | 33 ++++++++++++++++++++++++++++++---
 3 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7364d34e89..d0c1f420a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+### Added
+
+- New `regexp_expand` operator added to the `text` processor.
+
 ## 3.4.0 - 2019-11-12
 
 ### Added
diff --git a/docs/processors/README.md b/docs/processors/README.md
index 0af58330a1..cf24331bca 100644
--- a/docs/processors/README.md
+++ b/docs/processors/README.md
@@ -1855,9 +1855,36 @@ for control characters and other non-printable characters.
 
 #### `regexp_expand`
 
-Expands the template variables with the matched occurrences of the regular
-expression in a message. Inside the value $ signs are interpreted as submatch
-expansions, e.g. $1 represents the text of the first submatch.
+Expands each matched occurrence of the argument regular expression according to
+a template specified with the `value` field, and replaces the message
+with the aggregated results.
+
+Inside the template $ signs are interpreted as submatch expansions, e.g. $1
+represents the text of the first submatch.
+
+For example, given the following config:
+
+```yaml
+  - text:
+      operator: regexp_expand
+      arg: "(?m)(?P<key>\\w+):\\s+(?P<value>\\w+)$"
+      value: "$key=$value\n"
+```
+
+And a message containing:
+
+```text
+option1: value1
+# comment line
+option2: value2
+```
+
+The resulting payload would be:
+
+```text
+option1=value1
+option2=value2
+```
 
 #### `replace`
 
diff --git a/lib/processor/text.go b/lib/processor/text.go
index b2fae5df35..25cc939a20 100644
--- a/lib/processor/text.go
+++ b/lib/processor/text.go
@@ -87,9 +87,36 @@ for control characters and other non-printable characters.
 
 #### ` + "`regexp_expand`" + `
 
-Expands the template variables with the matched occurrences of the regular
-expression in a message. Inside the value $ signs are interpreted as submatch
-expansions, e.g. $1 represents the text of the first submatch.
+Expands each matched occurrence of the argument regular expression according to
+a template specified with the ` + "`value`" + ` field, and replaces the message
+with the aggregated results.
+
+Inside the template $ signs are interpreted as submatch expansions, e.g. $1
+represents the text of the first submatch.
+
+For example, given the following config:
+
+` + "```yaml" + `
+  - text:
+      operator: regexp_expand
+      arg: "(?m)(?P<key>\\w+):\\s+(?P<value>\\w+)$"
+      value: "$key=$value\n"
+` + "```" + `
+
+And a message containing:
+
+` + "```text" + `
+option1: value1
+# comment line
+option2: value2
+` + "```" + `
+
+The resulting payload would be:
+
+` + "```text" + `
+option1=value1
+option2=value2
+` + "```" + `
 
 #### ` + "`replace`" + `