# Backward regex replacement with gsub filter option

**URL:** <https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426>\
**Category:** Logstash\
**Created:** [May 16, 2019, 2:18pm UTC](https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426 "2019-05-16T14:18:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahulkothanath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahulkothanath/32/99122_2.png) [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Post date:** [May 16, 2019, 2:18pm UTC](https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426/1 "2019-05-16T14:18:44Z")

</div>

I want to match a text and replace it with matched value using gsub regex. we ususally do it using $1 which is regex backward reference.  
the below code contain my requirement

```
    filter {
      mutate {
        gsub => [
          # replace all forward slashes with underscore
          "fieldname", "/", "_$1",
          # replace backslashes, question marks, hashes, and minuses
          # with a dot "."
          "fieldname2", "a", "$2bc"
        ]
      }
    }

```

thanks for reading and helping.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 16, 2019, 2:37pm UTC](https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426/2 "2019-05-16T14:37:29Z")

</div>

Use \1 to refer to a capture group that uses parentheses ... for example

```
    mutate { add_field => { someField => "FooBarBaz" } }
    mutate { gsub => ["someField", "Foo(.*)Baz", "\1"] }

```

will result in "someField" containing "Bar"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2019, 2:37pm UTC](https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426/3 "2019-06-13T14:37:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.