Grok filter for email address alteration

Elastic Stack Beats
2

Still having fun in filter land....

tried these variations and also read up on KV as well but i don't think that would work here as i havn't yet declared a key ?

filter {
mutate {
gsub => [
"%{NOTSPACE:email_address}", "u0027]", "",
]
}
}

filter {
mutate {
gsub => [ "message", "u0027", "" ]
}
}

%{NOTSPACE:email_address}
filter {
mutate {
gsub => [ "message", "u0027", "" ]
}
}

%{GREEDYDATA}
filter {
mutate {
gsub => [
"%{NOTSPACE:email_address}", "u0027", "",
]
}
}

%{NOTSPACE:email_address}
filter {
kv {
trim => "u0027,"
}
}

with these i get no match, so i guess its either parsing the whole line and not matching or its not reading the line at all.
i removed everything and am just using the u0027alfie@alien.net so as to not complicate things.
Thing is, when im reading through the help sections that describe what filters do, how they work and how they are structured with the examples, they just don't seem to work, even with simple data like the malformed email address.

so let me try and get this straight..

%{NOTSPACE:email_address}

reads the data, shows me the output in the debug window.. great, parses the data, so now i need to alter the data in the field and then pass the altered data back to the field.

is that how this should be structured ?