# Issue with gsub and regex not affecting the resulting strings

**URL:** <https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570>\
**Category:** Logstash\
**Tags:** language-clients\
**Created:** [August 5, 2022, 7:47pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570 "2022-08-05T19:47:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![I\_need\_an\_adult](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/i_need_an_adult/32/109317_2.png) [@I\_need\_an\_adult](https://discuss.elastic.co/u/I_need_an_adult)\
**Post date:** [August 5, 2022, 7:47pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570/1 "2022-08-05T19:47:03Z")

</div>

Hello,

I'm attempting to remove specific items of a return string so that I have accurate aggregated filetypes within elasticsearch. The general format of the TrID output is this:

```auto
34.2% (.DLL) Win32 Dynamic Link Library (generic)
64.5% (.EXE) Win32 Executable MS Visual C++ (generic)
100% (.EXE) DOS Executable Generic
49.9% (.EXE) Generic Win/DOS Executable
33.9% (.EXE) Win 16/32 Executable Delphi Generic
81.9% (.EXE) Generic CLI Executable (.NET,Mono,etc)
79.7% (.EXE) Win32 EXE PECompact compressed (generic)
53.1% (.EXE) Win32 EXE PECompact compressed (v2.x)

```

I have a regex string to remove the beginning numerical percentages and the ending '(generic)' strings but I'm not getting results. This is in my .conf file for logstash. The field 'trid' is being pulled through a JDBC connection/query if that matters.

Filter code:

```auto
input {
   jdbc {
      connection info ....
   statement => "select id, name, ......, trid, ....."
}
filter {
  mutate {
      gsub => ["trid", "/\d+(\.\d+)*%\s(.*)(\s\(generic\))*$/gmU", ""]
}
output {
    elasticsearch {
       hosts => ["host"]
       index => ["index"]
     }
       stdout {}
}

```

What am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 5, 2022, 8:17pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570/2 "2022-08-05T20:17:04Z")

</div>

> [@I\_need\_an\_adult](#):
>
> ```
> mutate {
> gsub => ["trid", "/\d+(\.\d+)*%\s(.*)(\s\(generic\))*$/gmU", ""]
> }
> 
> ```

The second string in the array is converted to a Regexp, you cannot use // or modifiers. If you remove those it matches, and replaces the entire field with "". If you reference a capture group, by changing the third entry to "\2" then it still does not work, because the (.\*) captures the whole of the rest of the field, since the (generic) is optional. Use a second trio

```
mutate {
    gsub => [ 
        "message", "^\d+(\.\d+)*% ", "",
        "message", "\s\(generic\)$", ""
    ]
}

```

---

<div class="post-metadata">

**Author:** ![I\_need\_an\_adult](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/i_need_an_adult/32/109317_2.png) [@I\_need\_an\_adult](https://discuss.elastic.co/u/I_need_an_adult)\
**Post date:** [August 5, 2022, 8:39pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570/3 "2022-08-05T20:39:02Z")

</div>

I implemented your solution but there still isn't any change to the resulting output.

![trid_fail](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99a114f12cb45a9db2ba64b78338b36607fe2213.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 5, 2022, 8:41pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570/4 "2022-08-05T20:41:05Z")

</div>

Did you modify my mutate to update [trid] rather than [message]?

---

<div class="post-metadata">

**Author:** ![I\_need\_an\_adult](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/i_need_an_adult/32/109317_2.png) [@I\_need\_an\_adult](https://discuss.elastic.co/u/I_need_an_adult)\
**Post date:** [August 5, 2022, 8:45pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570/5 "2022-08-05T20:45:23Z")

</div>

That...that was it 🤦‍♂️ It works now. Thank you so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 2, 2022, 8:45pm UTC](https://discuss.elastic.co/t/issue-with-gsub-and-regex-not-affecting-the-resulting-strings/311570/6 "2022-09-02T20:45:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.