# Replace substring and concat rest
**URL:** https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622
**Category:** Logstash
**Created:** [June 18, 2020, 11:25am UTC](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622 "2020-06-18T11:25:27Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [June 18, 2020, 11:25am UTC](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622/1 "2020-06-18T11:25:28Z")
I have DNS Logs looks like
(14)xxxxxxxxxxxx(11)keydelivery(13)mediaservices(7)windows(3)net(0)
(4)mediaservices(7)windows(3)net(0)
(3)[windows.com](http://windows.com)(0)
I want to remove all (...) and replace this with a dot "."
if (..) is in front or end of the string i want to remove it.
Any clever approach without doing that in more steps like first cut the values and then build a new field out of the substrings?
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 18, 2020, 12:32pm UTC](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622/2 "2020-06-18T12:32:26Z")
Something like this might work:
```
mutate {
gsub => [
"message", "(^\(\d*\))|(\(\d*\)$)", "",
"message", "\(\d*\)", "."
]
}
```
---
### Author:  [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [June 18, 2020, 12:52pm UTC](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622/3 "2020-06-18T12:52:27Z")
Great help, thanks Jenni .... again 😉
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2020, 12:52pm UTC](https://discuss.elastic.co/t/replace-substring-and-concat-rest/237622/4 "2020-07-16T12:52:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.