# Replace same substring in multiple places in a text

**URL:** <https://discuss.elastic.co/t/replace-same-substring-in-multiple-places-in-a-text/151012>\
**Category:** Logstash\
**Created:** [October 4, 2018, 9:45am UTC](https://discuss.elastic.co/t/replace-same-substring-in-multiple-places-in-a-text/151012 "2018-10-04T09:45:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajaboini](https://avatars.discourse-cdn.com/v4/letter/r/7ab992/32.png) [@rajaboini](https://discuss.elastic.co/u/rajaboini)\
**Post date:** [October 4, 2018, 9:45am UTC](https://discuss.elastic.co/t/replace-same-substring-in-multiple-places-in-a-text/151012/1 "2018-10-04T09:45:36Z")

</div>

Hi All,

My name Raja,

I am new to elasticsearch

I am using logstash to pull data from my database and push to elasticsearch.

I have text content like below  
" "content": "attachment:37:gfggfg.csv:application/octet-stream:1538637460148-1538022841317-DatabaseERDiagram\_(10).csv:28608  
\<attachment:38:1538022841317-DatabaseERDiagram (11).csv:application/octet-stream:1538637460308-1538022841317-DatabaseERDiagram\_(11).csv:28608\>  
\<attachment:39:1538022841317-DatabaseERDiagram (12).csv:application/octet-stream:1538637460409-1538022841317-DatabaseERDiagram\_(12).csv:28608\>  
attachment:40:1538022841317-DatabaseERDiagram.csv:application/octet-stream:1538637460504-1538022841317-DatabaseERDiagram.csv:28608  
\<attachment:41:1538564055677-DatabaseERDiagram (1).csv:application/octet-stream:1538637460591-1538564055677-DatabaseERDiagram\_(1).csv:28608\>  
attachment:42:1538564055677-DatabaseERDiagram.csv:application/octet-stream:1538637460708-1538564055677-DatabaseERDiagram.csv:28608  
attachment:43:addendumplus\_logo\_r.png:image/png:1538637460801-addendumplus\_logo\_r.png:19527  
attachment:44:addendumplus\_logo\_r2.png:image/png:1538637460896-addendumplus\_logo\_r2.png:19527  
",

I want to replace each placeholder (like 'attachment:44:addendumplus\_logo\_r2.png:image/png:1538637460896-addendumplus\_logo\_r2.png:19527') with 2nd matching value (addendumplus\_logo\_r2.png).

for that i am using logstash gsub match with regex as below  
"mutate {  
gsub =\> ["content","\<attachment:(._):(._):(._):(._):(.\*)\>","\2"]  
}".

It is not working as i expected . It is replaced with last matched value like "addendumplus\_logo\_r2.png" insteadof "gfggfg.csv 1538022841317-DatabaseERDiagram (11).csv 1538022841317-DatabaseERDiagram (12).csv 1538022841317-DatabaseERDiagram.csv 1538564055677-DatabaseERDiagram (1).csv 1538564055677-DatabaseERDiagram.csv addendumplus\_logo\_r2.png".

is there a way do it?

thank  
Raja

"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2018, 9:45am UTC](https://discuss.elastic.co/t/replace-same-substring-in-multiple-places-in-a-text/151012/2 "2018-11-01T09:45:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.