### Author:  [@kurdit](https://discuss.elastic.co/u/kurdit)
#### Post date: [October 21, 2022, 3:15pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/1 "2022-10-21T15:15:56Z")
hi all! i ran into a problem.
i have a pipeline:
```auto
input {
tcp {
host => "10.10.10.10"
port => "5959"
codec => "json"
type => "my_type"
mode => "server"
}
}
filter {
if [type] == "my_type" {
grok {
match => {"message" => ['\#%{GREEDYDATA:who}%{SPACE}#%{GREEDYDATA:what}\n\n%{GREEDYDATA}: %{GREEDYDATA:contact}%{SPACE} #%{GREEDYDATA:ident}\n%{GREEDYDATA}Cost:%{SPACE}%{DATA:cost}\n%{GREEDYDATA}Date:%{SPACE}%{DATE_EU:when}\n%{GREEDYDATA}Vacant:%{SPACE}%{DATA:vacant}\n(?(.|\r|\n)*)\n\[%{GREEDYDATA}']
}
}
mutate {
gsub => [
"what", "milkshake", "Milk 🥛",
"what", "icecream", "Ice 🍦"
]
}
mutate {
gsub => [
"cost", "-1", "?",
"contact", "9", "+9"
]
}
mutate {
gsub => [
"contact", "\+9", "tel:+9"
]
}
if [date] {
date {
match => ["date", "ISO8601", "YYYY-MM-dd'T'HH:mm:ss.ZZZ"]
target => "@timestamp"
} }
if "_grokparsefailure" in [tags] {
drop {}
}
}
}
output {
if [type] == "my_type" {
elasticsearch {
hosts => ["https://localhost:9200"]
index => "my_type-%{+xxxx.ww}"
ilm_rollover_alias => "my_type"
ilm_policy => "my_type"
ilm_enabled => "true"
cacert => ["/etc/logstash/ca.crt"]
user => "elastic"
password => "password"
}
}
}
```
in the mutate section after the GROK i replace one word with another which will contain emoji and be capitalized
```auto
mutate {
gsub => [
"what", "milkshake", "Milk 🥛",
"what", "icecream", "Ice 🍦"
]
}
```
but in elasticsearch in the "what" field I see that the word is substituted with a non-capital letter "milk 🥛" instead of "Milk 🥛"
I tried to force mutate for the capital letter, but that doesn't help either ("mutate" for the capital letter was placed after the "mutate" for replacement)
```auto
mutate {
capitalize => ["what"]
}
```
What can be wrong?
---
### Author:  [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)
#### Post date: [October 23, 2022, 3:49pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/2 "2022-10-23T15:49:07Z")
Do you have something special in your index pattern mapping?
---
### Author:  [@kurdit](https://discuss.elastic.co/u/kurdit)
#### Post date: [October 23, 2022, 8:19pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/3 "2022-10-23T20:19:40Z")
no, as far as i know, nothing special
---
### Author:  [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)
#### Post date: [October 23, 2022, 8:47pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/4 "2022-10-23T20:47:34Z")
Maybe instead of gsub you could use the translate plugin?
---
### Author:  [@kurdit](https://discuss.elastic.co/u/kurdit)
#### Post date: [October 23, 2022, 8:50pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/5 "2022-10-23T20:50:27Z")
sorry what plugin are you talking about?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 23, 2022, 8:58pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/6 "2022-10-23T20:58:15Z")
> [@kurdit](#):
>
> What can be wrong?
First verify that the problem is not in logstash by looking at what is produced by
```
output { stdout { codec => rubydebug } }
```
(or a file output with that codec). If the problem is on the elasticsearch side it could be an [analyzer filter](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-lowercase-tokenfilter.html) or a [processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/lowercase-processor.html) in an ingestion pipeline.
---
### Author:  [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)
#### Post date: [October 23, 2022, 9:50pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/7 "2022-10-23T21:50:14Z")
This plugin
> **[Translate filter plugin | Logstash Reference \[8.4\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html)**
---
### Author:  [@kurdit](https://discuss.elastic.co/u/kurdit)
#### Post date: [October 23, 2022, 10:29pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/8 "2022-10-23T22:29:15Z")
with Translate filter pluginedit the same - the word is inserted in lowercase ☹
---
### Author:  [@kurdit](https://discuss.elastic.co/u/kurdit)
#### Post date: [October 23, 2022, 10:30pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/9 "2022-10-23T22:30:14Z")
no, i dont have analyzer or a processor in an ingestion pipeline
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 23, 2022, 10:59pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/10 "2022-10-23T22:59:40Z")
Does the rubydebug codec show it as uppercase or lowercase?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2022, 10:59pm UTC](https://discuss.elastic.co/t/pattern-grok-mutate-dont-work/317212/11 "2022-11-20T22:59:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.