# Regex in mutate filter
**URL:** https://discuss.elastic.co/t/regex-in-mutate-filter/233091
**Category:** Logstash
**Created:** [May 18, 2020, 11:15am UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091 "2020-05-18T11:15:01Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@priyanshuk](https://discuss.elastic.co/u/priyanshuk)
#### Post date: [May 18, 2020, 11:15am UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091/1 "2020-05-18T11:15:01Z")
Hi,
I need some help with regex in mutate
Part of log in message field : "LogError":"30180" - Please note number can vary .
in normal regex we can do grouping "LogError":"([0-9][0-9]\*)" and then get the matched regex using \1
But in kibana i am trying the below code but not sure how can i add the matched regex in errorcode field .Please note it is just a part of code there are multiple else if condition
if [message] =~ /."LogError":"[0-9][0-9]+".\*/
{
mutate
{ add\_field =\>
{ "error\_code" =\> "??" }
} }
---
### Author:  [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [May 18, 2020, 11:49am UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091/2 "2020-05-18T11:49:44Z")
Hi,
Mutate filter is not meant to extract data with regex. You should take a look instead at these filters:
- [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)
- [kv](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html)
---
### Author:  [@priyanshuk](https://discuss.elastic.co/u/priyanshuk)
#### Post date: [May 18, 2020, 12:24pm UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091/4 "2020-05-18T12:24:33Z")
Thanks for the reply.......my concern is i have written a generic grok filter ....
which should always be applied and apart from that i need to search for some error based on matched regex.
So can i have something similar
grok {
match =\> { "message" =\> "%{SPACE}%{DATESTAMP:time}%{SPACE}(%{WORD:factoryname})(%{NUMBER:consumer})%{GREEDYDATA:remainingmessage}(`)?" }
overwrite =\> "message"
}
if [message] =~ /.errors":[{"logerror":"[1-9][0-9]+".\*/ {
grok {
match =\> { "message" =\>"(?`errors":[{"logerror":"[1-9][0-9]+")" } }
}
else if ...`
---
### Author:  [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [May 18, 2020, 10:13pm UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091/5 "2020-05-18T22:13:43Z")
Can you add real log lines, at least one with "LogError" and one without it?
The grok patterns you added make it easier to troubleshoot your issue 🙂
If you go one step further and add log lines (and expected output if it's not trivial) will help to find the solution.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 15, 2020, 10:25pm UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091/6 "2020-06-15T22:25:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.