# Replace multiple patterns with gsub mutate filter

**URL:** https://discuss.elastic.co/t/replace-multiple-patterns-with-gsub-mutate-filter/51070
**Category:** Logstash
**Created:** [May 26, 2016, 2:52pm UTC](https://discuss.elastic.co/t/replace-multiple-patterns-with-gsub-mutate-filter/51070 "2016-05-26T14:52:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![auerbecktj](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@auerbecktj](https://discuss.elastic.co/u/auerbecktj)
#### Post date: [May 26, 2016, 2:52pm UTC](https://discuss.elastic.co/t/replace-multiple-patterns-with-gsub-mutate-filter/51070/1 "2016-05-26T14:52:06Z")

</div>

I'm trying to write a mutate filter that will replace a certain set of symbols as well as a string in a certain field that we've defined. Currently we're trying to do something like :slight\_smile :slight\_smile :

mutate {  
add\_field =\> { "event\_type" =\> "" }  
gsub =\> [  
"application","string[\="]",""  
]  
}

What I want the above to do is replace the word string, backslashes, equal signs and quotation marks. This isn't working as expected, so we would appreciate any help that anyone can provide. We'd prefer to keep this as one line per field, which is why I don't just seperate the gsub for the string and the special characters.

---

<div class="post-metadata">

### Author: ![auerbecktj](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@auerbecktj](https://discuss.elastic.co/u/auerbecktj)
#### Post date: [May 26, 2016, 9:07pm UTC](https://discuss.elastic.co/t/replace-multiple-patterns-with-gsub-mutate-filter/51070/2 "2016-05-26T21:07:44Z")

</div>

Looks like this did the job:

"application","string|["\=]",""

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/replace-multiple-patterns-with-gsub-mutate-filter/51070/3 "2017-07-06T04:56:01Z")

</div>


