# Replace paths in every field
**URL:** https://discuss.elastic.co/t/replace-paths-in-every-field/287106
**Category:** Logstash
**Created:** [October 19, 2021, 2:34pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106 "2021-10-19T14:34:38Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)
#### Post date: [October 19, 2021, 2:34pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/1 "2021-10-19T14:34:38Z")
Hello,
I've been trying to edit my logstash.config so that all file paths in all fields are changed to "anonym".
```auto
input {
http {
port => 5044
codec => json
}
}
filter {
split {
field => "events"
target => "event"
remove_field => "events"
}
ruby {
code => 'event.to_hash.each { |k, v|
if v == "(?:[\w]\:|\\)(\\[A-Z\a-z_\-\s0-9\.]+)+(\.(txt|gif|pdf|doc|docx|xls|xlsx|log))?"
event.set(k, "anonym")
end
}'
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "scs-%{+YYYY.MM.dd}"
}
}
```
That's my attempt but it's not working. I've tried something simpler instead of the RegEx but still nothing happens.
Thanks in advance
---
### Author:  [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [October 19, 2021, 5:35pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/2 "2021-10-19T17:35:21Z")
You should use a [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) filter instead.
FYI: I have not tested this config, but I hope you get the general idea.
Use a grok filter to figure out if it matches the pattern.
If it does match (\_grokparsefailure is NOT thrown) then replace the event with "anonym".
If \_grokparsefailure IS thrown then you know that there is no path in your event field.
Then always remove \_grokparsefailure tag.
```auto
grok {
match => {"event" => "%{PATH}"}
}
if "_grokparsefailure" not in ["tags"] {
mutate {
replace => {"event" => "anonym"}
}
}
mutate {
remove_tag ["_grokparsefailure"]
}
```
---
### Author:  [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)
#### Post date: [October 28, 2021, 10:12am UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/3 "2021-10-28T10:12:30Z")
Thanks for your help 🙂
Is there a way to just change the path in the fields to "anonym" and not the whole event?
---
### Author:  [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [November 1, 2021, 3:12pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/4 "2021-11-01T15:12:14Z")
I thought that the field was called "event". You have to replace the field with whatever you want inside of it, there is no easy way to just replace a path inside of a field. If you want to do that you'll have to do some ruby coding and fancy regex.
---
### Author:  [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)
#### Post date: [November 3, 2021, 5:33pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/5 "2021-11-03T17:33:59Z")
Yes, that's what I've tried at the top. I've tested the regex and it should work. But nothing happens at all. I don't know what's wrong with my ruby code.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 3, 2021, 6:15pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/6 "2021-11-03T18:15:59Z")
> [@AnneHermann](#):
>
> `if v == "(?:[\w]\:|\\)(\\[A-Z\a-z_\-\s0-9\.]+)+(\.(txt|gif|pdf|doc|docx|xls|xlsx|log))?"`
Did you mean `if v =~ ...`? You are doing a string literal comparison, not a regexp match.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2021, 6:16pm UTC](https://discuss.elastic.co/t/replace-paths-in-every-field/287106/7 "2021-12-01T18:16:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.