# Logstash replace string problem

**URL:** <https://discuss.elastic.co/t/logstash-replace-string-problem/103401>\
**Category:** Logstash\
**Created:** [October 10, 2017, 3:21pm UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401 "2017-10-10T15:21:38Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arkadiusz](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@Arkadiusz](https://discuss.elastic.co/u/Arkadiusz)\
**Post date:** [October 10, 2017, 3:21pm UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/1 "2017-10-10T15:21:38Z")

</div>

Hi

I'm new to the logstash and don't know if what I want to do is even possible. I need to replace some information in logs provided by an application. My example input is:  
`2017-09-18 10:45:25,404 ERROR some variable text 10.23.42.45 some variable text 10.45.22.111`  
Task for me is to replace those IP's with other text. At first I tried to use below grok:

> ```
> grok{
> match => {"log" => ["%{DATA}(?<ip>%{IPV4})%{GREEDYDATA}"]}
> }
> if "_grokparsefailure" not in [tags]{
> mutate{
> gsub => ["log","%{ip}","SOMEIP"]
> }
> }
> 
> ```

But this way I'm only replacing the first IP and the second one stays unchanged as grok takes first match and moves further, I tried to use %{IPV4} pattern inside mutate but it doesn't work. The main problem is that logs that I have to parse aren't standardized and I have to search for those IP inside a message. Also the occurrence of those IP inside a message varies.

---

<div class="post-metadata">

**Author:** ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)\
**Post date:** [October 10, 2017, 3:37pm UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/2 "2017-10-10T15:37:35Z")

</div>

Hi @Arkadiusz,

first and important, play around with the grok debugger, its a powerfull tool for testing this kind of stuff 🙂

[Grok Debugger](https://grokdebug.herokuapp.com/)

then you should try something like this:

```
2017-09-18 10:45:25,404 ERROR some variable text 10.23.42.45 some variable text 10.45.22.111

%{TIMESTAMP_ISO8601}%{DATA}%{IPV4}%{DATA}%{IPV4}

```

just as an example.

```
if [IPV4] {
   mutate...
  }

```

`if ![IPV4]`  
looks for "not exists"

`if [IPV4]`  
looks for "exists"

Cheers,  
Dirk

---

<div class="post-metadata">

**Author:** ![Arkadiusz](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@Arkadiusz](https://discuss.elastic.co/u/Arkadiusz)\
**Post date:** [October 10, 2017, 3:53pm UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/3 "2017-10-10T15:53:25Z")

</div>

Hi @lueneburger  
Thank you for fast response. I was using grok debugger but like I wrote the logs aren't standardized and this was only an example to show what I want to accomplish. And as the occurrence of the IP and the number of times it occurs varies so my Grok Pattern would have to look more like this:

`"%{DATA}(?<ip1>%{IPV4})%{DATA}(?<ip2>%{IPV4})%{DATA}(?<ip3>%{IPV4})%{DATA}(?<ip4>%{IPV4})%{DATA}"`

Which I wanted to avoid, and what if there will be 5th IP etc. Best solution would be to use a loop but from what I found out there is no _for_ statement for logstash.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2017, 4:16pm UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/4 "2017-10-10T16:16:04Z")

</div>

The gsub function of the mutate filter might help, depending on what text you want to replace the IPs with.

---

<div class="post-metadata">

**Author:** ![Arkadiusz](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@Arkadiusz](https://discuss.elastic.co/u/Arkadiusz)\
**Post date:** [October 11, 2017, 5:04am UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/5 "2017-10-11T05:04:44Z")

</div>

Hi  
Yeah I have tried this but the problem is that IP's are different and mutate gsub replace one string with another, and when i tried to use pattern %{IPV4} with mutate it didn't worked.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2017, 6:13am UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/6 "2017-10-11T06:13:18Z")

</div>

There's no need to use grok to locate the exact IP address first. Just use gsub:

```nohighlight
mutate {
  gsub => ["message", "\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b", "FOO"]
}

```

(You could use a more exact regexp to match an IP address but this one's probably good enough.)

---

<div class="post-metadata">

**Author:** ![Arkadiusz](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@Arkadiusz](https://discuss.elastic.co/u/Arkadiusz)\
**Post date:** [October 11, 2017, 7:35am UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/7 "2017-10-11T07:35:13Z")

</div>

Hi @magnusbaeck  
Thank you this is exactly what I was looking for.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2017, 7:35am UTC](https://discuss.elastic.co/t/logstash-replace-string-problem/103401/8 "2017-11-08T07:35:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.