# Gsub remove words less than 4 characters in length

**URL:** <https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649>\
**Category:** Logstash\
**Created:** [September 6, 2020, 12:48am UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649 "2020-09-06T00:48:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [September 6, 2020, 12:48am UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/1 "2020-09-06T00:48:00Z")

</div>

I am attempting to use a gsub mutate to remove words that are less than 4 characters in length.

`mutate { gsub => ["[tag][cloud][chat]", "(\S+){1,3}", "" ] }`

But it is removing everything. Any suggestions?

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [September 6, 2020, 1:04am UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/2 "2020-09-06T01:04:38Z")

</div>

I am also attempting to remove URLs but that doesn't seem to be working either.

```
mutate { gsub => ["[tag][cloud][chat]", "(http:\S+)", "" ] }
mutate { gsub => ["[tag][cloud][chat]", "(https:\S+)", "" ] }
```

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [September 6, 2020, 1:05am UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/3 "2020-09-06T01:05:02Z")

</div>

But these two gsubs ARE working.

```
mutate { gsub => ["[tag][cloud][chat]", "(\[emote=\S+\])", "" ] }
mutate { gsub => ["[tag][cloud][chat]", "(@\S+)", "" ] }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 6, 2020, 1:31am UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/4 "2020-09-06T01:31:24Z")

</div>

> [@kopacko](#):
>
> mutate { gsub =\> ["[tag][cloud][chat]", "(\S+){1,3}", "" ] }

If you have a word of seven characters in that field then I would expect that pattern to remove 3, then to remove 3 again, and then to remove 1. Which would remove the entire word. You need to anchor the patterns.

Perhaps "(^|\b)\S{1,3}(\b|$)" ?...

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [September 6, 2020, 9:47pm UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/5 "2020-09-06T21:47:45Z")

</div>

That worked for the words less than 4 characters.

Thank you!!!

Do you have a suggestion for removing any URLs?? Nothing seems to work for me, at this point. I was trying to cover http and https but I am going to need to make sure I cover ftp as well.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 6, 2020, 10:11pm UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/6 "2020-09-06T22:11:29Z")

</div>

I suggest you look at the [grok patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns) for URLs and maybe extract parts of those. A complete URL would be

```auto
[A-Za-z]([A-Za-z0-9+\-.]+)+://(?:[a-zA-Z0-9._-]+(?::[^@]*)?@)?(?:(?:(?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?|(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))|\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)))(?::\b(?:[1-9][0-9]*)\b)?)?(?:(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%&_\-]*)+(?:\?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*)?)?

```

😃

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [September 6, 2020, 11:50pm UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/7 "2020-09-06T23:50:52Z")

</div>

I actually have it working now 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2020, 11:50pm UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649/8 "2020-10-04T23:50:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.