# Replace filter not working properly after upgrade to logstash 7.1.1

**URL:** <https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209>\
**Category:** Logstash\
**Created:** [November 17, 2019, 9:10am UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209 "2019-11-17T09:10:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumitpramanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumitpramanik/32/102380_2.png) [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\
**Post date:** [November 17, 2019, 9:10am UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209/1 "2019-11-17T09:10:04Z")

</div>

Hi All,

I am trying to replace the timestamp parsed from my message with existing timestamp + year (parsed from the source of the file).

This below code was working perfectly in logstash 6.7.2 but after upgrading to 7.1.1 its not working anymore.

timestamp = [system][netlog][timestamp]  
source = /syslog-data/DC1/NETWORK-DEVICES/UDP/IP/2018/09/IP-2018-09-17.log

=================================CODE==================================  
grok {  
match =\> { "source" =\> "/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{YEAR:year}/%{GREEDYDATA}/%{GREEDYDATA}"}  
}

mutate {  
replace =\> ["[system][netlog][timestamp]", "%{[system][netlog][timestamp]} %{year}" ]  
}

date {  
match =\> [  
"[system][netlog][timestamp]",  
"MMM d HH:mm:ss YYYY",  
"MMM dd HH:mm:ss YYYY"  
]  
target =\> "@timestamp"  
}

mutate {  
remove\_field =\> ["year"]  
}  
==================================CODE END====================================

After this the value of [system][netlog][timestamp] becomes Sep 17 00:00:02 %{year}, but previously it was giving the output Sep 17 00:00:02 2018

Please help and thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 17, 2019, 6:57pm UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209/2 "2019-11-17T18:57:04Z")

</div>

If you comment out the remove\_field does [year] exist?

That grok pattern could be really expensive (not sure if it is expensive enough to timeout). I would change it to

```
grok { match => { "source" => "/%{YEAR:year}/"} }
```

---

<div class="post-metadata">

**Author:** ![sumitpramanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumitpramanik/32/102380_2.png) [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\
**Post date:** [November 18, 2019, 9:38am UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209/3 "2019-11-18T09:38:46Z")

</div>

> [@sumitpramanik](#):
>
> /syslog-data/DC1/NETWORK-DEVICES/UDP/IP/2018/09/IP-2018-09-17.log

Nope, your recommended solution didn't work. It just print the `%{year}` whereas it should put the value of `%{year}`.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 18, 2019, 2:25pm UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209/4 "2019-11-18T14:25:11Z")

</div>

If you comment out the remove\_field does [year] exist?

---

<div class="post-metadata">

**Author:** ![sumitpramanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumitpramanik/32/102380_2.png) [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\
**Post date:** [November 19, 2019, 3:56am UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209/5 "2019-11-19T03:56:39Z")

</div>

no, it does't exist. But after a bit of tweaking here and there i found that after replacing the double quotation `"%{[system][netlog][timestamp]} %{year}"` with single quotation `'%{[system][netlog][timestamp]} %{year}'` it solved the problem. I don't know know why!! But hey its works. 😛

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2019, 3:56am UTC](https://discuss.elastic.co/t/replace-filter-not-working-properly-after-upgrade-to-logstash-7-1-1/208209/6 "2019-12-17T03:56:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.