# Mutate Gsub not working **URL:** \ **Category:** Logstash\ **Created:** [May 25, 2018, 10:45am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304 "2018-05-25T10:45:06Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 25, 2018, 10:45am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/1 "2018-05-25T10:45:06Z")
Hello, I'm currently extracting data from Elasticsearch to a CSV using logstash, however I have some fields that returns a null, so I would have in my CSV, something like: 1,,2,3,4,,,,2. My configuration is the following: ``` input { elasticsearch { hosts => "xxxx" index => "xxxx" scroll => "1m" query => '{"query": {"match_all":{}},"sort": ["item"]}' } } filter { mutate { gsub => [ "color", "39225", "qwerty" ] } } output { csv { path => "outputNewES.csv" fields => ["item","color"] } } ``` Do you know what I'm doing wrong? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 25, 2018, 3:25pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/2 "2018-05-25T15:25:46Z")
Impossible to say given the limited information you have posted. If you can show a document from output { stdout { codec =\> rubydebug } } we might hazard a guess. ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 28, 2018, 7:38am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/3 "2018-05-28T07:38:05Z")
Hello, thanks for your response. By putting stdout { codec =\> rubydebug } I just get the same I get on Postman. After further testing and investigation I can now replace Strings, however I can not replace null or long values. For example, in Postman I have this field with the following value: ``` "vendorId": 450, "eanProvider": "1111111111111", "eanInternal": null, ``` How do i replace the int and the null? I've tried this without sucess ``` "vendorId","450","111", "eanInternal","null","eanInternal" ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 28, 2018, 1:40pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/4 "2018-05-28T13:40:16Z")
If you do not need a regular expression then for integers you can test for a particular value and then mutate+replace. For nil values you can mutate+coerce. ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 28, 2018, 1:43pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/5 "2018-05-28T13:43:30Z")
Can you please provide me an example? I've tried: ``` "vendorNum", "111", "222" "vendorNum", 111, 222 ``` The first doesn't work and the second says I have a syntax error due to the lack of "". The same happens when I'm identifying null values. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 28, 2018, 1:54pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/6 "2018-05-28T13:54:37Z")
What I meant is ```auto if [vendorId] == 450 { mutate { replace => { "vendorId" => "111" } } mutate { coerce { "eanInternal" => "eanInternal" } } ``` ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 28, 2018, 2:04pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/7 "2018-05-28T14:04:12Z")
Hmm I see, and where should I put that? Inside a ruby tag? ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 28, 2018, 2:32pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/8 "2018-05-28T14:32:40Z")
I've managed to use coerce to replace a string null, but not long null. Which means: ``` coerce => {"eanInternal" => 1234569}---> this doesn't coerce => {"validityEndDate"=>"date"}---> this works ``` ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 28, 2018, 2:45pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/9 "2018-05-28T14:45:37Z")
Turns out it was a problem with the if clause. Without the if I don't have any problem with the coerce. Where should I put it? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 28, 2018, 2:45pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/10 "2018-05-28T14:45:53Z")
How about this? ```auto mutate { coerce { "eanInternal" => "1234569" } } mutate { convert { "eanInternal" => "integer" } } ``` ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 28, 2018, 3:01pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/11 "2018-05-28T15:01:57Z")
Turns out the problem was the if clause, it's misplaced. I've putted inside the filter, but outside the mutate. Where should I put it? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 28, 2018, 4:22pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/12 "2018-05-28T16:22:30Z")
The coerce does not need to be conditional, since it only takes effect if the field is nil. For the mutate+replace my original post shows how the conditional should be written. ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 29, 2018, 7:39am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/13 "2018-05-29T07:39:37Z")
My configuration is the following: ``` input { elasticsearch { hosts => "xxx" index => "xxx" scroll => "1m" query => '{"query": {"match_all":{}},"sort": ["xxx"]}' } } filter { if [vendorId] == 450 { mutate { replace => { "vendorId" => "111" } } mutate { gsub => [ "xxx", "xxx", "xxx" ] coerce => {"xxx" => 666} } } output { csv { path => "outputNewES.csv" fields => ["xxx""] } } ``` I have an error with this configuration due to the if clause ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 29, 2018, 11:45am UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/14 "2018-05-29T11:45:59Z")
Yes, because you should have three } at the end of the line, not just two. ---
**Author:** ![npontes](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@npontes](https://discuss.elastic.co/u/npontes)\ **Post date:** [May 29, 2018, 12:20pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/15 "2018-05-29T12:20:24Z")
yap, you're completely correct. Thank you so much for the help ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2018, 12:20pm UTC](https://discuss.elastic.co/t/mutate-gsub-not-working/133304/16 "2018-06-26T12:20:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.