# Filling value into placeholder in a field

**URL:** <https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126>\
**Category:** Logstash\
**Created:** [April 1, 2020, 9:17pm UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126 "2020-04-01T21:17:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saurabh\_Singh1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saurabh_singh1/32/63178_2.png) [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\
**Post date:** [April 1, 2020, 9:17pm UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126/1 "2020-04-01T21:17:39Z")

</div>

Hi ,  
I have a field named 'message'. This field contains data like,

```
  message : 'My IP is {%source_ip}.This {%source.ip} is external ip.'

```

I want to replace all the instance of this placeholder {%source\_ip} , with a value. Can anybody  
help me how to do this.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2020, 10:57pm UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126/2 "2020-04-01T22:57:26Z")

</div>

Use [mutate+gsub](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub).

---

<div class="post-metadata">

**Author:** ![Saurabh\_Singh1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saurabh_singh1/32/63178_2.png) [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\
**Post date:** [April 2, 2020, 4:52am UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126/3 "2020-04-02T04:52:50Z")

</div>

Thank you @Badger ,  
I tried doing this ,  
mutate {  
gsub =\> [

```
      "message", "{%source.ip}", "1.1.1.1",
    ]
  } 

```

And the source ip got replaced , but in my scenario ,the value to be replaced is not predefined ( ie 1.1.1.1). I want to replace this with value of another field that is.("source. ip").

For example:

"newfield" : "12.12.12.1"

```
                        mutate {
    gsub => [
      
      "message", "{%source.ip}", "<value of the newfield>",
    ]
  } 

```

Any help how can i get this ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 2, 2020, 3:01pm UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126/4 "2020-04-02T15:01:02Z")

</div>

You may be able to use a [sprintf](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf) reference. If gsub does not do the sprintf you may be able to make mutate+copy process the reference that you gsub in.

---

<div class="post-metadata">

**Author:** ![Saurabh\_Singh1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saurabh_singh1/32/63178_2.png) [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\
**Post date:** [April 8, 2020, 7:51pm UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126/5 "2020-04-08T19:51:00Z")

</div>

Thanks a ton @badger it worked. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2020, 7:51pm UTC](https://discuss.elastic.co/t/filling-value-into-placeholder-in-a-field/226126/6 "2020-05-06T19:51:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.