# My gsub doesn't recognize predefined patterns. What am I missing?

**URL:** <https://discuss.elastic.co/t/my-gsub-doesnt-recognize-predefined-patterns-what-am-i-missing/89082>\
**Category:** Logstash\
**Created:** [June 12, 2017, 5:01pm UTC](https://discuss.elastic.co/t/my-gsub-doesnt-recognize-predefined-patterns-what-am-i-missing/89082 "2017-06-12T17:01:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![brandondash](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@brandondash](https://discuss.elastic.co/u/brandondash)\
**Post date:** [June 12, 2017, 5:01pm UTC](https://discuss.elastic.co/t/my-gsub-doesnt-recognize-predefined-patterns-what-am-i-missing/89082/1 "2017-06-12T17:01:59Z")

</div>

I'm trying to do a string replace on every MONTH in my message, but when I run it nothing gets replaced:

```
            if "foo" in [tags] {
                    mutate {
                            gsub => [
                                    "message",
                                    "%{MONTH}",
                                    "FOOBARBAZ"
                            ]
                    }
            }

```

I manually plugged in the regular expression for the MONTH pattern and it works fine:

```
            if "foo" in [tags] {
                    mutate {
                            gsub => [
                                    "message",
                                    "\b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b",
                                    "FOOBARBAZ"
                            ]
                    }
            }

```

Clearly I'm missing something obvious. Problem is I don't know what!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 13, 2017, 5:38am UTC](https://discuss.elastic.co/t/my-gsub-doesnt-recognize-predefined-patterns-what-am-i-missing/89082/2 "2017-06-13T05:38:25Z")

</div>

gsub doesn't support grok patterns.

---

<div class="post-metadata">

**Author:** ![brandondash](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@brandondash](https://discuss.elastic.co/u/brandondash)\
**Post date:** [June 13, 2017, 2:03pm UTC](https://discuss.elastic.co/t/my-gsub-doesnt-recognize-predefined-patterns-what-am-i-missing/89082/3 "2017-06-13T14:03:07Z")

</div>

Well that's a huge letdown. My regular expression is like 80 lines when I pull in the patterns I need. Oh well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2017, 2:03pm UTC](https://discuss.elastic.co/t/my-gsub-doesnt-recognize-predefined-patterns-what-am-i-missing/89082/4 "2017-07-11T14:03:21Z")

</div>

Closed on July 11, 2017, 2:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.