# Asterisk in Mutate with GSUB **URL:** \ **Category:** Logstash\ **Created:** [March 31, 2018, 4:47am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300 "2018-03-31T04:47:37Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Suman\_Reddy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suman_reddy1/32/27303_2.png) [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\ **Post date:** [March 31, 2018, 4:47am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/1 "2018-03-31T04:47:38Z")
@magnusbaeck Here is the thing, which broken in our production. ``` mutate { gsub => ["message", "%{docNumber}", "%{docNumberMasked}"] } ``` I have to type all the configuration, if there is any typo or syntactical errors please dont mind. docNumber value is \*. docNumberMasked is also \* Now because of this our production Logstash went down saying `` When I used multiple pipelines my understanding is that it should not impact logstash, if anything happens it will only shutdown that particular pipeline, but because of this our entire logstash instance went down. Is this something expected ? Anyhow I configured only 1 pipeline for this Logstash instance. Second: Is there way to inform Logstash such that it wont shutdown but it will keep a track of such events ? Can I achieve this using dead\_letter\_queue? Thanks, Suman G ---
**Author:** ![Suman\_Reddy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suman_reddy1/32/27303_2.png) [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\ **Post date:** [April 2, 2018, 5:06pm UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/2 "2018-04-02T17:06:47Z")
@magnusbaeck any help here? ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [April 5, 2018, 1:32am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/3 "2018-04-05T01:32:38Z")
@Suman_Reddy1 directly pinging individual members when they have not explicitly offered their help, is rude. Please refrain from doing this. * * * This shouldn't be taking down the whole process, but the mutate plugin explicitly warns about regex special characters in the gsub directive. That said, I can't think of a reliable way to do string substitution using existing plugins. Perhaps the Ruby filter may be our best bet here (the following is pseudo-configs and has not been tested): ```auto filter { ruby { code => " message = event.get('message') message && begin docNumber = event.get('[docNumber]') docNumberMasked = event.get('[docNumberMasked]') event.set('message', message.tr(docNumber, docNumberMasked)) end " } } ``` ---
**Author:** ![Suman\_Reddy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suman_reddy1/32/27303_2.png) [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\ **Post date:** [April 5, 2018, 1:39am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/4 "2018-04-05T01:39:51Z")
> [@yaauie](#): > > directly pinging individual members when they have not explicitly offered their help, is rude. Please refrain from doing this. Thank you! Will not happen again. Please understand that this is a prod issue, ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [April 5, 2018, 5:53am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/5 "2018-04-05T05:53:22Z")
> [@Suman\_Reddy1](#): > > Please understand that this is a prod issue, These are _community_ forums, where the community of people who maintain and use these products help each other out, as we have time. The user you tagged is fairly active here and often provides valuable insight, but no one on these forums has any obligation to drop what they are doing to address your issue. If you would like real-time production support, you may be interested in one of Elastic's [subscriptions](https://www.elastic.co/subscriptions), which provide dedicated access to a team of support engineers who can provide valuable feedback tailor-fit for your specific use-case. ---
**Author:** ![Suman\_Reddy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suman_reddy1/32/27303_2.png) [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\ **Post date:** [April 5, 2018, 5:51pm UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/6 "2018-04-05T17:51:00Z")
Noted. Thank you @yaauie I am still trying to scratch my head to find out why logstash process went down. Any idea? ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [April 5, 2018, 6:36pm UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/7 "2018-04-05T18:36:22Z")
I've opened up a ticket on the mutate filter plug in here: - [logstash-plugins/logstash-filter-mutate#122](https://github.com/logstash-plugins/logstash-filter-mutate/issues/122) ---
**Author:** ![Suman\_Reddy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suman_reddy1/32/27303_2.png) [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\ **Post date:** [April 6, 2018, 1:33am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/8 "2018-04-06T01:33:36Z")
Thankyou @yaauie ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 4, 2018, 1:33am UTC](https://discuss.elastic.co/t/asterisk-in-mutate-with-gsub/126300/9 "2018-05-04T01:33:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.