# Mutate and gsub usage
**URL:** https://discuss.elastic.co/t/mutate-and-gsub-usage/351769
**Category:** Logstash
**Created:** [January 25, 2024, 6:23am UTC](https://discuss.elastic.co/t/mutate-and-gsub-usage/351769 "2024-01-25T06:23:44Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Sara93](https://discuss.elastic.co/u/Sara93)
#### Post date: [January 25, 2024, 6:23am UTC](https://discuss.elastic.co/t/mutate-and-gsub-usage/351769/1 "2024-01-25T06:23:44Z")
Hi,
I was trying to fetch below fileds from the log
`2024-01-10 04:21:52.018 -06:00 [INF] [2696100223720240110042151-10] {"Message":"Device_Response_2696100223720240110042151-10","ApiEndPoint":"ws://10.136.41.18:50000/","ResponseCode":"","Store":"2696","Terminal":"100","TransactionId":"2237","CorrelationId":"2696100223720240110042151-10","RequestPayload":"{"request":{"resource":{"type":"info"},"flow_id":"2696100223720240110042151-10","endpoint":"/upp/v1/device"}","ResponsePayload":"{"response" : {"endpoint" : "/upp/v1/device","flow_id" : "2696100223720240110042151-10","resource" : {"status" : "completed","unit_data" : {"application" : "Unified Payment Platform","battery" : {"battery_charging_state" : "NotAvailable","battery_level" : "N/A"},"contactless_emv" : {"config" : "/HOST/EMVCLESS.XML","contactless_interface_support" : "Yes","discover_kernel_version" : "020000","expresspay_v2_kernel_version" : "NONE","expresspay_v3_kernel_version" : "070100","interac_kernel_version" : "020500","jspeedy_kernel_version" : "040300","paypass_v3_app_version" : "030700","paypass_v3_kernel_version" : "090200","upi_kernel_version" : "040700","visa_paywave_kernel_version" : "070803"},"emv" : {"config" : "/HOST/EMVCONTACT.XML","engine_version" : "063400","kernel_version" : "090600"},"general" : {"device_model" : "L7000","ecr_no" : "3456","manufacture" : "INGNAR","manufacture_serial_no" : "24694446","unit_serial_no" : "3011295624694446"},"memory" : {"flash_size" : "491040","ram_size" : "506116"},"transaction" : {"cashback_limit" : "999999"},"version" : {"application_version" : "7.83.27-0022","digitizer_version" : "0000","eftl_version" : "0100","eftp_version" : "0100","os_version" : "0506","pci_version" : "0.0.0.0.00.00-0000","security_module_version" : "0508"}}}","TimeTaken":"00:00:00.3931037","TimeStamp":null,"Exception":null,"LogLevel":"Information","LogLevelEnum":2}`
Fields to fetch:
1. Terminal
2. Apiendpoint
3. store
4. application version
5. transaction id
Wrote a grok pattern like below
```auto
%{TIMESTAMP_ISO8601:app_timestamp}%{SPACE}%{GREEDYDATA}\]%{SPACE}%{GREEDYDATA:response}RequestPayload%{GREEDYDATA}application_version%{GREEDYDATA:application_version}digitizer_version
```
Grok Simulate:
```auto
{
"response": "{\"Message\":\"Device_Response_2696100223720240110042151-10\",\"ApiEndPoint\":\"ws://10.136.41.18:50000/\",\"ResponseCode\":\"\",\"Store\":\"2696\",\"Terminal\":\"100\",\"TransactionId\":\"2237\",\"CorrelationId\":\"2696100223720240110042151-10\",\"",
"app_timestamp": "2024-01-10 04:21:52.018",
"application_version": "\" : \"7.83.27-0022\",\""
```
How can I get the
1. Terminal
2. Apiendpoint
3. store
4. transaction id
using mutate and gsub?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 25, 2024, 5:53pm UTC](https://discuss.elastic.co/t/mutate-and-gsub-usage/351769/2 "2024-01-25T17:53:39Z")
edit 0
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 25, 2024, 6:25pm UTC](https://discuss.elastic.co/t/mutate-and-gsub-usage/351769/3 "2024-01-25T18:25:15Z")
If your [message] contain valid JSON then you could use something like
```
mutate { gsub => ["message", "^[^{]+{", "{" ] }
json { source => "message" target => "[@metadata][json]" }
mutate {
rename => {
"[@metadata][json][TransactionId]" => "TransactionId"
"[@metadata][json][Terminal]" => "Terminal"
}
}
```
to pull out the fields you want. However, it is either missing escapes on the excess double quotes or it needs some double quotes removed and } added.
Since you want so little of the JSON data another approach would be
```
grok {
break_on_match => false
match => {
"message" => [
'"TransactionId"\s*:\s*"%{NUMBER:TransactionId}"',
'"ApiEndPoint"\s*:\s*"%{URI:ApiEndPoint}"',
'"Terminal"\s*:\s*"%{NUMBER:Terminal}"'
]
}
}
```
---
### Author:  [@Sara93](https://discuss.elastic.co/u/Sara93)
#### Post date: [January 29, 2024, 12:32pm UTC](https://discuss.elastic.co/t/mutate-and-gsub-usage/351769/4 "2024-01-29T12:32:11Z")
Hi,
I have tried above code and its not fetching the fields. Can you guide to fix the below code which I have written below to fetch data.
```auto
filter
{
if "Terminal" in [message] and "ApiEndPoint" in [message] and "application_version" in [message] and "store" in [message] and "TransactionId" in [message]
{
grok
{
match => {
"message" =>"%{TIMESTAMP_ISO8601:app_timestamp}%{SPACE}%{GREEDYDATA}\]%{SPACE}%{GREEDYDATA:response}RequestPayload%{GREEDYDATA}application_version%{GREEDYDATA:application_version}digitizer_version"
}
}
mutate {
gsub => ["response", "^[^{]+{", "{" ]
}
mutate {
remove_field => ["Message"]
}
if ApiEndPoint in [response]
{
grok
{
match => {
"response"
=>"%{URI:ApiEndPoint}"
}
}
mutate {
remove_field => ["ResponseCode"]
}
kv {
value_split => ":"
field_split => ","
}
}
else
{
drop{}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 26, 2024, 12:33pm UTC](https://discuss.elastic.co/t/mutate-and-gsub-usage/351769/5 "2024-02-26T12:33:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.