# How to include %{} variable in the gsub

**URL:** <https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482>\
**Category:** Logstash\
**Created:** [December 17, 2015, 3:02pm UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482 "2015-12-17T15:02:56Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![darshan](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@darshan](https://discuss.elastic.co/u/darshan)\
**Post date:** [December 17, 2015, 3:02pm UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/1 "2015-12-17T15:02:56Z")

</div>

Hi,  
I am new to logstash, and i stuck in parsin some antivirus log .  
Can any one please tell me how to use dynamic variable like %{} in the gsub to replace.

Thank you

-Regards  
darshan

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 17, 2015, 3:35pm UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/2 "2015-12-17T15:35:46Z")

</div>

That should work just fine. Please show us what you've tried, what happens, and what you expected should've happened. Are you sure the field you're trying to use actually exists?

---

<div class="post-metadata">

**Author:** ![darshan](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@darshan](https://discuss.elastic.co/u/darshan)\
**Post date:** [December 17, 2015, 3:55pm UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/3 "2015-12-17T15:55:30Z")

</div>

11/24/2015 12:46:45 PM "F:\sysusb\usbdur.exe" "BackDoor-EGK" "2" 11/24/2015 12:46:57 PM "F:\e9naq.exe" "[PWS-OnlineGames.gs](http://PWS-OnlineGames.gs)" "2" 11/24/2015 12:47:03 PM Total objects scanned: 1298 11/24/2015 12:47:03 PM  
i need to match %{DATE} %{TIME} (AM|PM)

Thank You

-Regards  
darshan

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 17, 2015, 4:01pm UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/4 "2015-12-17T16:01:49Z")

</div>

What do you mean? You want to extract the date and time from the message? Or replace them?

---

<div class="post-metadata">

**Author:** ![darshan](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@darshan](https://discuss.elastic.co/u/darshan)\
**Post date:** [December 20, 2015, 3:53am UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/5 "2015-12-20T03:53:40Z")

</div>

I want to replace them

---

<div class="post-metadata">

**Author:** ![darshan](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@darshan](https://discuss.elastic.co/u/darshan)\
**Post date:** [December 21, 2015, 4:26am UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/6 "2015-12-21T04:26:20Z")

</div>

@magnusbaeck Please help me regarding this problem. how can I replace date and time field from the above log.

Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 2, 2016, 7:25pm UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/7 "2016-01-02T19:25:11Z")

</div>

You are giving to few details. What do you want to replace the date and time with? If you give an example of an original log line and how you want it transformed it'll be much easier to understand what you're trying to accomplish.

---

<div class="post-metadata">

**Author:** ![darshan](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@darshan](https://discuss.elastic.co/u/darshan)\
**Post date:** [January 4, 2016, 4:57am UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/8 "2016-01-04T04:57:46Z")

</div>

Thank you @magnus , i solved that problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482/9 "2017-07-06T05:17:01Z")

</div>

Closed on July 6, 2017, 5:17am UTC