# Syntax error
**URL:** https://discuss.elastic.co/t/syntax-error/324471
**Category:** Logstash
**Created:** [February 1, 2023, 6:08pm UTC](https://discuss.elastic.co/t/syntax-error/324471 "2023-02-01T18:08:56Z")
**Posts on this page:** 1
**Showing post:** 3
### Author:  [@moep](https://discuss.elastic.co/u/moep)
#### Post date: [February 1, 2023, 11:47pm UTC](https://discuss.elastic.co/t/syntax-error/324471/3 "2023-02-01T23:47:06Z")
> [@Badger](#):
>
> That said, it is unclear why you do not
I have an e-mail in my logline. The logline looks like that:
```auto
SMTP error from remote mail server after RCPT TO::
host domain.com [xx.xx.xx.xx]: 550-Please turn on SMTP Authentication in your mail client.
550-(host.domain.com) [yy.yy.yy.yy]: __ is not permitted to relay through this server without authentication.
```
iam only interested into the e-mail adress. So I take `gsub` to remove `TO:<`.
`update => { "exim_msg_state" => "error" }` this is just only a kind of failre counter, so its not connected with `gsub`.
For more information see here [Issue in Controls - #23 by moep](https://discuss.elastic.co/t/issue-in-controls/320882/23)
What I dont understand is, where the syntax error is.
---
_[View the full topic](https://discuss.elastic.co/t/syntax-error/324471)._