# Issues with Gsub moving from Logstash 7 to 8

**URL:** <https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189>\
**Category:** Logstash\
**Created:** [November 28, 2024, 1:14pm UTC](https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189 "2024-11-28T13:14:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_e/32/47012_2.png) [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\
**Post date:** [November 28, 2024, 1:14pm UTC](https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189/1 "2024-11-28T13:14:27Z")

</div>

Hi all, as the title says, I'm experiencing some issues with GSUB, moving from logstash 7 to logstash 8. I discarded a problem with ECS compatibility (I didn't think it was involved here, but just in case), so it must be due to the changes in Java or jruby, I don't know because I can't find any documentation.

The situation is as follows, I have a pipeline where I send raw logs that are then processed as json, but before turning them into JSON, I have to obfuscate all "username;password" messages.

```auto
mutate {
		gsub => ["message", '(?<=Password[\=])(.*(?=;)|.+?(?=\"))', "##REDACTED##" ]
	}

```

And the part of the message it is supposed to obfuscate looks like this:

```auto
"message": "Whatever=Dummy;Password=Kitty"

```

as it is part of a raw log, **before being parsed as json** , it will look something like:

```auto
\"message\": \"Whatever=Dummy;Password=Kitty\",

```

This does work in logstash 7, and all the regex testers match it perfectly.

Any idea of what could be wrong?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 28, 2024, 2:11pm UTC](https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189/3 "2024-11-28T14:11:53Z")

</div>

```
input { generator { count => 1 lines => ['{"message": "Whatever=Dummy;Password=Kitty"}'] } }
output { stdout { codec => rubydebug { metadata => false } } }
filter {
    mutate { gsub => ["message", '(?<=Password[\=])(.*(?=;)|.+?(?=\"))', "##REDACTED##" ] }
}

```

works in 8.16. Can you provide a reproducible example that does not work?

---

<div class="post-metadata">

**Author:** ![Jose\_E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_e/32/47012_2.png) [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\
**Post date:** [November 28, 2024, 3:12pm UTC](https://discuss.elastic.co/t/issues-with-gsub-moving-from-logstash-7-to-8/371189/4 "2024-11-28T15:12:29Z")

</div>

Thank you Badger, thanks to you I found the problem. Turns out the event.original which is the one that returned a different value, was populated from the beginning, so I just had to overwrite it after doing the gsub.