# Gsub with regex

**URL:** <https://discuss.elastic.co/t/gsub-with-regex/322756>\
**Category:** Elastic Agent\
**Tags:** ingest-pipeline\
**Created:** [January 9, 2023, 6:14pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756 "2023-01-09T18:14:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![searchtastic](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@searchtastic](https://discuss.elastic.co/u/searchtastic)\
**Post date:** [January 9, 2023, 6:14pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756/1 "2023-01-09T18:14:46Z")

</div>

Hi,

My regex is matching my condition on my ingest pipeline, however I am struggling to wrap my found string with quotes for the replacement.

expression.

```auto
    "gsub": {
      "field": "message",
      "pattern": "\b[0-9]+\b(?!')",
      "replacement": """\\1"""

```

Sample data.

```auto
'eventId': '82102699', 'status': 'Live-Processing', 'duration': 904, 'eventStartTime': '1673052296'

```

The regex works and I can replace the 904, What I can't work out is how to provide this value as 'number' e.g. '904'. escaping the value with the backslashes means I end up with a literal '\1' as the value, any ideas?

---

<div class="post-metadata">

**Author:** ![searchtastic](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@searchtastic](https://discuss.elastic.co/u/searchtastic)\
**Post date:** [January 10, 2023, 4:32pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756/2 "2023-01-10T16:32:26Z")

</div>

I fixed it with

```
"gsub": {
  "field": "message",
  "pattern": "(\\b[0-9]+\\b(?!'))",
  "replacement": "'$1'"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2023, 4:32pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756/3 "2023-02-07T16:32:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.