# Syntax error
**URL:** https://discuss.elastic.co/t/syntax-error/324471
**Category:** Logstash
**Created:** [February 1, 2023, 6:08pm UTC](https://discuss.elastic.co/t/syntax-error/324471 "2023-02-01T18:08:56Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@moep](https://discuss.elastic.co/u/moep)
#### Post date: [February 1, 2023, 6:08pm UTC](https://discuss.elastic.co/t/syntax-error/324471/1 "2023-02-01T18:08:56Z")
Hey there,
I'm working playing with Logstash and wrote alot of grok patterns. But right now, I have a syntax error in this snippet:
```auto
if [message] =~ "SMTP error from remote mail server after RCPT TO" {
grok {
"match" => { "message" => " (%{EMAILADDRESS:exim_sender})" }
}
mutate {
copy => { "exim_sender" => "exim_sender_tmp" }
gsub => ["exim_sender_tmp", "TO:<", ""]
copy => { "exim_sender_tmp"} => "exim_sender" }
update => { "exim_msg_state" => "error" }
}
```
and tbo I'm not 100% sure, how these mutate filters work. Mostly I just use `update`. But I also used a mutate like:
```auto
mutate {
update => { "field" => "foobar" }
gsub => ["foobar", "o", ""] #this entry is fbar
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 1, 2023, 6:42pm UTC](https://discuss.elastic.co/t/syntax-error/324471/2 "2023-02-01T18:42:13Z")
A mutate filter does operations in a [fixed order](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order), not in the order specified in the configuration. That said, it is unclear why you do not
```
mutate {
gsub => ["exim_sender", "TO:<", ""]
update => { "exim_msg_state" => "error" }
}
```
---
### Author:  [@moep](https://discuss.elastic.co/u/moep)
#### Post date: [February 1, 2023, 11:47pm UTC](https://discuss.elastic.co/t/syntax-error/324471/3 "2023-02-01T23:47:06Z")
> [@Badger](#):
>
> That said, it is unclear why you do not
I have an e-mail in my logline. The logline looks like that:
```auto
SMTP error from remote mail server after RCPT TO::
host domain.com [xx.xx.xx.xx]: 550-Please turn on SMTP Authentication in your mail client.
550-(host.domain.com) [yy.yy.yy.yy]: __ is not permitted to relay through this server without authentication.
```
iam only interested into the e-mail adress. So I take `gsub` to remove `TO:<`.
`update => { "exim_msg_state" => "error" }` this is just only a kind of failre counter, so its not connected with `gsub`.
For more information see here [Issue in Controls - #23 by moep](https://discuss.elastic.co/t/issue-in-controls/320882/23)
What I dont understand is, where the syntax error is.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 2, 2023, 12:32am UTC](https://discuss.elastic.co/t/syntax-error/324471/4 "2023-02-02T00:32:40Z")
> [@moep](#):
>
> `copy => { "exim_sender_tmp"} => "exim_sender" }`
You should remove the first }
Also if you change the grok to
```
grok { "match" => { "message" => "%{EMAILADDRESS:exim_sender}" } }
```
then you will get
```
"exim_sender" => "user@domain.com"
```
and you will not need most of the mutate.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2023, 12:33am UTC](https://discuss.elastic.co/t/syntax-error/324471/5 "2023-03-02T00:33:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.