# Mutate gsub Email Address

**URL:** <https://discuss.elastic.co/t/mutate-gsub-email-address/53878>\
**Category:** Logstash\
**Created:** [June 24, 2016, 10:08am UTC](https://discuss.elastic.co/t/mutate-gsub-email-address/53878 "2016-06-24T10:08:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pedro\_Lopes](https://avatars.discourse-cdn.com/v4/letter/p/e0b2c6/32.png) [@Pedro\_Lopes](https://discuss.elastic.co/u/Pedro_Lopes)\
**Post date:** [June 24, 2016, 10:08am UTC](https://discuss.elastic.co/t/mutate-gsub-email-address/53878/1 "2016-06-24T10:08:06Z")

</div>

Hello guys,

I'm using ELK for 2 days now, to parse a CSV and see it in Kibana. My doubt is about mutate.

I have a field with a email address I can easily do this:

mutate{  
gsub=\> ["col2",".\*@","@"]  
}

In this case I replace what is after @ (including @) with @, so the email remains something like this @gmail.com

But this is for a column that only has a email address, I've been testing for a column that contains a sentence and a email, for instance:

'My name is xxx and my email is [xxx@gmail.com](mailto:xxx@gmail.com)'

What I'm looking for, is to replace xxx@ by @. Can anyone help?

Thanks in advanced

---

<div class="post-metadata">

**Author:** ![Pedro\_Lopes](https://avatars.discourse-cdn.com/v4/letter/p/e0b2c6/32.png) [@Pedro\_Lopes](https://discuss.elastic.co/u/Pedro_Lopes)\
**Post date:** [June 24, 2016, 10:49am UTC](https://discuss.elastic.co/t/mutate-gsub-email-address/53878/2 "2016-06-24T10:49:48Z")

</div>

Actually just done it, after more than 20 tries.

I recommend this to find @ in a sentence:

mutate{  
gsub =\> ["col2","(\W|^)[\w.+-]{0,100}@"," @"]  
}

It finds the @ and what is before until the first space is found then it replace for @

Hope it helps, if anyone has a better solution, feel free to share!

Cheers

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/mutate-gsub-email-address/53878/3 "2017-07-06T04:50:54Z")

</div>