# GSUB & Regular Expression

**URL:** <https://discuss.elastic.co/t/gsub-regular-expression/263442>\
**Category:** Logstash\
**Created:** [February 5, 2021, 5:23pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442 "2021-02-05T17:23:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [February 5, 2021, 5:23pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442/1 "2021-02-05T17:23:26Z")

</div>

I have a text field being ingested that I want to remove an email disclaimer from, unfortunately, I can't figure out the correct syntax to remove it. I've got the mutate filter setup in the following way:

```auto
mutate {
  gsub => [
    "notes", 'Disclaimer[\s\S]*?\.(\n|$)', ''
  ]
}

```

The disclaimer shows in Kibana table view like this:

```auto
Disclaimer

The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.

```

In Kibana JSON view, it looks like this:

```auto
Disclaimer\n\nThe information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.\n

```

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [February 5, 2021, 6:12pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442/2 "2021-02-05T18:12:39Z")

</div>

That's all correct...the field I was targeting was capitalized... 🤦‍♂️

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2021, 6:12pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442/3 "2021-03-05T18:12:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.