Replace same substring in multiple places in a text

[rajaboini]

Hi All,

My name Raja,

I am new to elasticsearch

I am using logstash to pull data from my database and push to elasticsearch.

I have text content like below
" "content": "attachment:37:gfggfg.csv:application/octet-stream:1538637460148-1538022841317-DatabaseERDiagram_(10).csv:28608
<attachment:38:1538022841317-DatabaseERDiagram (11).csv:application/octet-stream:1538637460308-1538022841317-DatabaseERDiagram_(11).csv:28608>
<attachment:39:1538022841317-DatabaseERDiagram (12).csv:application/octet-stream:1538637460409-1538022841317-DatabaseERDiagram_(12).csv:28608>
attachment:40:1538022841317-DatabaseERDiagram.csv:application/octet-stream:1538637460504-1538022841317-DatabaseERDiagram.csv:28608
<attachment:41:1538564055677-DatabaseERDiagram (1).csv:application/octet-stream:1538637460591-1538564055677-DatabaseERDiagram_(1).csv:28608>
attachment:42:1538564055677-DatabaseERDiagram.csv:application/octet-stream:1538637460708-1538564055677-DatabaseERDiagram.csv:28608
attachment:43:addendumplus_logo_r.png:image/png:1538637460801-addendumplus_logo_r.png:19527
attachment:44:addendumplus_logo_r2.png:image/png:1538637460896-addendumplus_logo_r2.png:19527
",

I want to replace each placeholder (like 'attachment:44:addendumplus_logo_r2.png:image/png:1538637460896-addendumplus_logo_r2.png:19527') with 2nd matching value (addendumplus_logo_r2.png).

for that i am using logstash gsub match with regex as below
"mutate {
gsub => ["content","<attachment:(.):(.):(.):(.):(.*)>","\2"]
}".

It is not working as i expected . It is replaced with last matched value like "addendumplus_logo_r2.png" insteadof "gfggfg.csv 1538022841317-DatabaseERDiagram (11).csv 1538022841317-DatabaseERDiagram (12).csv 1538022841317-DatabaseERDiagram.csv 1538564055677-DatabaseERDiagram (1).csv 1538564055677-DatabaseERDiagram.csv addendumplus_logo_r2.png".

is there a way do it?

thank
Raja

"