# How to replace a String with another string in a field while Re-indexing an old Index
**URL:** https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905
**Category:** Logstash
**Created:** [May 12, 2016, 1:46pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905 "2016-05-12T13:46:33Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [May 12, 2016, 1:46pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/1 "2016-05-12T13:46:33Z")
Hi,
I'm trying to Re-Index an old index in which I have to replace a String with another in a field. Here is the old index data.
From this I want to replace "Mr.Rakesh Kumar" with "RK" in the new Index.
I have tried
input {
elasticsearch {
host =\> ["localhost"]
index =\> "student\_info\_idx"
}
}
filter {
mutate {
gsub =\> ["patientName","Mr%","X"]
}
}
output
{
elasticsearch\_http
{
host =\> "localhost"
index =\> "student\_idx\_new"
index\_type =\> "student\_idx\_new"
}
stdout
{
codec =\> "json"
}
}
But Nothing has changed in the new Index. Please suggest me how to do this.
Thanks and Regards,
Sanjay Reddy
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 12, 2016, 9:05pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/2 "2016-05-12T21:05:15Z")
I invite you to try :
```
filter {
mutate {
gsub => ["patientName","Mr.(\w)\w* (\w)\w*","\1\2"]
}
}
```
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [May 13, 2016, 1:11pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/3 "2016-05-13T13:11:18Z")
This works fine. Thanks @fbaligand
Is there a way to provide the field value and replace it in gsub???
like
filter {
mutate {
gsub =\> ["Summary","value("patientName")","\1\2"]
}
}
Here I want to replace the value of "patientName" field in "Summary" with some other String.
Is it possible. If yes, Can you please guide me through this?
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 13, 2016, 3:38pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/4 "2016-05-13T15:38:39Z")
You can do it using 2 mutate filters :
```
filter {
mutate {
add_field => {"Summary" => "%{patientName}"}
}
}
filter {
mutate {
gsub => ["Summary","Mr.(\w)\w* (\w)\w*","\1\2"]
}
}
```
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [May 18, 2016, 8:55am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/5 "2016-05-18T08:55:50Z")
Thanks for the suggestion @fbaligand but this is not working for me ☹
Let me be clear from my end. I have two fields "patientName" and "Summary".
"Summary" field contains the "patientName" . I want to remove the name from Summary field. Please help
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 18, 2016, 9:38am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/6 "2016-05-18T09:38:46Z")
OK, to be clearer, could you give an example with input document and expected output document.
Something like this :
```
INPUT DOC :
{
Summary => "..."
patientName => "..."
}
OUTPUT DOC :
{
Summary => "..."
patientName => "..."
}
```
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [May 18, 2016, 10:06am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/7 "2016-05-18T10:06:49Z")
Here I'm giving you the smaple data
In this, what ever present in the "patientName" field should not appear in Summary field while reindexing. This is the requirement which I have
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 18, 2016, 1:25pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/8 "2016-05-18T13:25:09Z")
OK, I understand your need.
Note there is a little problem : content in "patientName" field is not exactly content contained in "Summary" field :
Mr Rakesh Kumar \<=\> Mr. Rakesh Kumar \<=\> Mr.Rakesh
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [May 18, 2016, 1:37pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/9 "2016-05-18T13:37:12Z")
Yeah that problem exist. But If there is a possibility to take the Content of the field "patientName", then we may use some regex to solve. I am stuck at the initial stage itself
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 18, 2016, 2:49pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/10 "2016-05-18T14:49:49Z")
OK.
So I invite you to try this logstash configuration :
```
mutate {
add_field => {"[@metadata][initials]" => "%{patientName}"}
}
mutate {
gsub => ["[@metadata][initials]", "Mr.(\w)\w* (\w)\w*", "\1\2"]
}
mutate {
gsub => ["Summary", "%{patientName}", "%{[@metadata][initials]}"]
}
```
It works fine with this input data :
```
"patientName" => "Mr.Rakesh Kumar"
"Summary" => "Student: Mr.Rakesh Kumar is not performing well in the class. Please take care of Mr.Rakesh Kumar to get better result."
```
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [June 2, 2016, 11:23am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/11 "2016-06-02T11:23:22Z")
Thanks for the clue @fbaligand
Based on your suggestion I have tried this.
mutate {
split =\> ["Name" , " "]
add\_field =\> ["FName", "%{[Name][0]}" ]
add\_field =\> ["LName", "%{[Name][1]}" ]
}
mutate {
gsub =\> ["history", "(?i)(?:[%{LName}])", "\*\*\*"]
}
mutate {
gsub =\> ["history", "(?i)(?:[%{FName}])", "\*\*\*"]
}
Now this is taking each and every letter in to consideration. How to make it to consider the entire word?
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [June 2, 2016, 11:50am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/12 "2016-06-02T11:50:33Z")
I'm really not sure to understand the result you expect.
Can you give an example with input document (with "Name" and "history" fields) and expected output document ?
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [June 2, 2016, 12:07pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/13 "2016-06-02T12:07:58Z")
Sorry @fbaligand my bad, It's not "history", it is "summary".
The data in the field "StudentName" is "Mr. Rakesh Kumar". I want to replace whatever is present in the "StudentName" with "\*\*\*" in the entire index. So, I have taken "Summary" field for testing.
As the Name in the "StudentName" is not same in the remaining fields in the index (might be "Rakesh" OR "Mr Rakesh OR "rakesh kumar" not sure), I have divided the "StudentName" field to "FName" and "LName".
So, I thought if I apply CaseInsensitivity for "FName" and "LName" and replace with "\*\*\*" using gsub, task will be done.
Lets say "summary" = "rakesh is a good student. Rakesh kumar have to undergo some training. Mr rakesh Kumar will be provided a certificate."
After applying the filters, the final result should be
"summary" = "\*\*\* is a good student. \*\*\* \*\*\* have to undergo some training. Mr \*\*\* \*\*\* will be provided a certificate."
Hope you got the point. Please let me know if I should explain more!!!
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [June 2, 2016, 12:55pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/14 "2016-06-02T12:55:35Z")
OK, I understand now 🙂
With StudentName="Mr. Rakesh Kumar", here's the right logstash configuration :
```
grok {
match => { "StudentName" => "%{NOTSPACE:Courtesy} %{NOTSPACE:FName} %{NOTSPACE:LName}" }
}
mutate {
gsub => ["summary", "(?i:%{FName})", "***"]
}
mutate {
gsub => ["summary", "(?i:%{LName})", "***"]
}
```
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [June 2, 2016, 2:27pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/15 "2016-06-02T14:27:38Z")
@fbaligand
Thank you sooo much 🙂 It worked!!!
I have been trying for this from quite long time.
Thanks a ton 🙂
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [June 2, 2016, 2:54pm UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/16 "2016-06-02T14:54:02Z")
You're welcome 🙂
---
### Author:  [@sanju1323](https://discuss.elastic.co/u/sanju1323)
#### Post date: [June 7, 2016, 10:39am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/17 "2016-06-07T10:39:52Z")
@fbaligand
Need one more help.
Can you please look into this issue. I'm not able to index this.
> [@Index a text file into elasticsearch using logstash](https://discuss.elastic.co/t/index-a-text-file-into-elasticsearch-using-logstash/51584):
>
> Is there a way to index a text file which has the data in the following format. Date Time : 23/05/2016-12.01.38.AM File : log Reason : parser is not working Stack : at java.util.package(Exception e) at java.util.package(Exception1 e) ^^-------------------------------------------------------------------^^ Date Time : 23/05/2016-12.01.38.AM File : log Reason : parser is working Stack : at java.lang.package(Exception e) at java.lang.package(Exception1 e) ^…
Please help me
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/how-to-replace-a-string-with-another-string-in-a-field-while-re-indexing-an-old-index/49905/18 "2017-07-06T04:54:20Z")