# Mutate gsub - re-using regex

**URL:** <https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243>\
**Category:** Logstash\
**Created:** [October 8, 2021, 1:10pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243 "2021-10-08T13:10:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JimJ](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@JimJ](https://discuss.elastic.co/u/JimJ)\
**Post date:** [October 8, 2021, 1:10pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243/1 "2021-10-08T13:10:06Z")

</div>

Hi everybody,

I would like to parttially remove the end of a string like that:

```auto
mutate {
        gsub => [
          "fieldname", "(:[0-5][0-9].\d{3})\d*$", "what_is_between_brackets"
        ]
      }

```

Context: I parse dates that can contain more than millisecond as decimal (4 to 5 digits after the decimal point).

But the date plugin can only manage date up to milliseconds and fails if there is more than 3 digits after the decimal point.

So, the idea is to gsub the string removing digits after the third.

Any suggestion is welcome.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 8, 2021, 1:40pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243/2 "2021-10-08T13:40:28Z")

</div>

What does your field looks like? Can you give an example of the values?

I have a similar case with a field that has unix epoch time with a precision in the microseconds or more, I use the truncate filter to keep only the milisecond precison.

This is what I do:

```auto
truncate {
    fields => "[@metadata][timestamp]"
    length_bytes => 13
}

```

Maybe you can do something similar depending on how does your field looks like.

---

<div class="post-metadata">

**Author:** ![JimJ](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@JimJ](https://discuss.elastic.co/u/JimJ)\
**Post date:** [October 8, 2021, 2:13pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243/3 "2021-10-08T14:13:06Z")

</div>

Hi Leandro,

This is an example:  
`2021-09-28 10:33:08.0454`  
So, this should do the trick:

```auto
truncate {
    fields => "my_field"
    length_bytes => 23
}

```

Okay, thank you for this.  
I'll apply it to my logstash filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2021, 2:13pm UTC](https://discuss.elastic.co/t/mutate-gsub-re-using-regex/286243/4 "2021-11-05T14:13:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.