# Help with mutate gsub filter in logstash

**URL:** <https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047>\
**Category:** Logstash\
**Created:** [September 26, 2018, 3:49pm UTC](https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047 "2018-09-26T15:49:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jason27](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jason27](https://discuss.elastic.co/u/jason27)\
**Post date:** [September 26, 2018, 3:49pm UTC](https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047/1 "2018-09-26T15:49:47Z")

</div>

Hello, I will like to strip off the last character for a field and I donot know why this is not working in logstash.

I have a field named "app\_name" which ends with something like "dashboard\_webapp:" and I will like to strip-off the colon ":" at the end

I am using the gsub filter like this `gsub => ["app_name", ":$", ""]` and it doesn't work.

Entire block

`mutate { gsub => ["app_name", ":$", ""] }`

Can someone please suggest a proper way to achieving this?

Thanks

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 26, 2018, 5:47pm UTC](https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047/2 "2018-09-26T17:47:50Z")

</div>

I just tried your input on Logstash 6.4.0, and it seems to work as intended.

```auto
╭─{ yaauie@castrovel:~/src/elastic/discuss-scratch/150047-mutate-gsub-trailing-colon }
╰─○ echo '{"app_name":"dashboard_webapp:"}' | ${LOGSTASH_HOME}/bin/logstash -e 'input { stdin { codec => json } } filter { mutate { gsub => ["app_name", ":$", ""] } }'
Sending Logstash logs to /Users/yaauie/src/elastic/releases/logstash-6.4.0/logs which is now configured via log4j2.properties
[2018-09-26T17:43:45,404][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-09-26T17:43:45,913][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.4.0"}
[2018-09-26T17:43:48,264][INFO][logstash.pipeline] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-09-26T17:43:48,383][INFO][logstash.inputs.stdin] Automatically switching from json to json_lines codec {:plugin=>"stdin"}
[2018-09-26T17:43:48,436][INFO][logstash.pipeline] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x3b09a39d run>"}
[2018-09-26T17:43:48,505][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2018-09-26T17:43:49,079][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
{
      "app_name" => "dashboard_webapp",
      "@version" => "1",
    "@timestamp" => 2018-09-26T17:43:48.578Z,
          "host" => "castrovel.local"
}
[2018-09-26T17:43:49,195][INFO][logstash.pipeline] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#<Thread:0x3b09a39d run>"}
[success (21.000s)]

```

* * *

What version of Logstash are you using?

```auto
${LOGSTASH_HOME}/bin/logstash --version

```

What version of the Mutate filter plugin does it have loaded?

```auto
${LOGSTASH_HOME}/bin/logstash-plugin list --verbose logstash-filter-mutate

```

---

<div class="post-metadata">

**Author:** ![jason27](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jason27](https://discuss.elastic.co/u/jason27)\
**Post date:** [September 27, 2018, 8:16am UTC](https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047/3 "2018-09-27T08:16:38Z")

</div>

> [@yaauie](#):
>
> /bin/logstash --version

Hello @yaauie, this is a fresh installation I did this week

Logstash version : 6.4.1

Mutate filter plugin: 3.3.3

---

<div class="post-metadata">

**Author:** ![jason27](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jason27](https://discuss.elastic.co/u/jason27)\
**Post date:** [September 27, 2018, 2:22pm UTC](https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047/4 "2018-09-27T14:22:41Z")

</div>

Apparently, my setup did not work because I had multiple `gsub lines` in one mutate filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2018, 2:22pm UTC](https://discuss.elastic.co/t/help-with-mutate-gsub-filter-in-logstash/150047/5 "2018-10-25T14:22:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.