logstash gsub regex replace use capture group

logstashgsub.conf

input { 
  generator {
    lines => [
      "whatever|1|BA|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||61033|",
      "whatever|1|BP|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||61033|",
      "whatever|1|SA|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||61033|",
      "whatever|1|SP|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||61033|",
      "whatever|1|BC|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||61033|",
      "whatever|1|SC|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||61033|",
      "whatever|1|BF|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||",
      "whatever|1|SF|110100|11:19:39|1|101.00000|whatever|123456789||10.000|||"
      ]
    count => 1
  }
}

filter {

   mutate {
     gsub => [
       "message", "^(\w+\|1)\|SA", "\1|S",
       "message", "^(\w+\|1)\|SP", "\1|S",
       "message", "^(\w+\|1)\|BA", "\1|B",
       "message", "^(\w+\|1)\|BP", "\1|B",
       "message", "^(\w+\|1)\|BC", "\1|C",
       "message", "^(\w+\|1)\|SC", "\1|C",
       "message", "^(\w+\|1)\|BF", "\1|F",
       "message", "^(\w+\|1)\|SF", "\1|F"
     ]
   }

}

output { stdout { codec => rubydebug } }