# Replace field with regex group match
**URL:** https://discuss.elastic.co/t/replace-field-with-regex-group-match/65025
**Category:** Logstash
**Created:** [November 4, 2016, 4:04pm UTC](https://discuss.elastic.co/t/replace-field-with-regex-group-match/65025 "2016-11-04T16:04:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@irom77](https://discuss.elastic.co/u/irom77)
#### Post date: [November 4, 2016, 4:04pm UTC](https://discuss.elastic.co/t/replace-field-with-regex-group-match/65025/1 "2016-11-04T16:04:06Z")
Hey,
How do I replace field with regex group match , see example below.
```
mutate {
gsub => [
"message",",\\\"(.+)\\\",",
]
}
```
My message is here, I am targetting that ,"FN WebFix.exe", :
`<141>Nov 3 12:53:35 MR-DC1-PFWP02.cor.com 1,2016/11/03 12:53:35,001901000999,THREAT,file,1,2016/11/03 12:53:35,10.4.21.127,10.111.0.98,0.0.0.0,0.0.0.0,from REPVPN and SSLVPN,wm\\mo.admin,,ms-ds-smb,vsys1,app,rep,ae1.20,ae2.192,LF-elk,2016/11/03 12:53:35,33891243,1,445,53368,0,0,0x0,tcp,alert,\"FN WebFix.exe\",Microsoft PE File(52060),any,low,server-to-client,5210010,0x0,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,0,,0,,,0,,,,,,,,0,38,0,0,0,PROD,MR-DC1-PFWP02,`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 4, 2016, 6:24pm UTC](https://discuss.elastic.co/t/replace-field-with-regex-group-match/65025/2 "2016-11-04T18:24:10Z")
You could a) use a grok filter or b) use gsub twice (once to remove the leading quote and once to remove the trailing quote).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/replace-field-with-regex-group-match/65025/3 "2017-07-06T04:30:59Z")