# Translate filter regex capture grouping
**URL:** https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922
**Category:** Logstash
**Created:** [April 12, 2021, 5:18pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922 "2021-04-12T17:18:16Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@aap323](https://discuss.elastic.co/u/aap323)
#### Post date: [April 12, 2021, 5:18pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922/1 "2021-04-12T17:18:16Z")
Hi, I am using Logstash to parse and enter graphite metrics into InfluxDB. However, I wanted to create a large dictionary source where it can match certain metric lines based on their pattern and reorganize the string based on the delimiter - "."
I know the translate filter can do this, also it can be done via mutate and gsub. I could not find documentation on how to use the regex to create capture groups and place them in the resultant string. Example:
`job.cm_attributes.timer.CMTopology.processor.DiscoveryResponse.succeeded`
`job.cm_equalization.timer.CMHierarchy.processor.ExplorerResponse.succeeded`
I would like the above two to be reorganized to:
`timer.CMTopology.job.cm_attributes.processor.DiscoveryResponse.succeeded`
`timer.CMHierarchy.job.cm_equalization.processor.ExplorerResponse.succeeded`
Notice that the fields are slightly swapped around, that's all. Would I be able to do this through some kind of capture group in translate (note the $1,2,3,4 are the captured groups)?
```auto
field => "name"
exact => true
regex => true
destination => "name"
override => "true"
dictionary => [
"job\.(^[^.]+$)\.timer\.(^[^.]+$)\.processor\.(^[^.]+$)\.(.*)", "timer.$2.job.$1.processor.$3.$4"
]
}
```
If I need to use gsub for this, anyone know if I can source the mapping like translate can from a different file?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 12, 2021, 5:28pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922/2 "2021-04-12T17:28:04Z")
> [@aap323](#):
>
> I could not find documentation on how to use the regex to create capture groups and place them in the resultant string.
I do not believe the translate filter can do that. The [code](https://github.com/logstash-plugins/logstash-filter-translate/blob/8165bdc148c4bb728408a523a3d27417ec2af713/lib/logstash/filters/fetch_strategy/memory.rb#L30) just clones the value of the dictionary entry.
[mutate+gsub](https://github.com/logstash-plugins/logstash-filter-mutate/blob/883c8b007c41e2c8cf0107447e3de87baee7e89e/lib/logstash/filters/mutate.rb#L232) just processes the entries in the array in the configuration, it cannot read them from a file.
---
### Author:  [@aap323](https://discuss.elastic.co/u/aap323)
#### Post date: [April 12, 2021, 5:31pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922/3 "2021-04-12T17:31:50Z")
That is what I figured, unfortunately. I suppose mutate+gsub would give me the best results for what I need, and I'm sure I can definitely similarly to the translate array of regex patterns but not from an external file, just a reaaaally long list in the actual filter. Thanks! I'll see if anyone has any secret/hidden input.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 12, 2021, 6:04pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922/4 "2021-04-12T18:04:53Z")
Note that the code for mutate+gsub is right there on github. You could repurpose it.
Use a ruby filter. In the init section read in a file and populate an array with fieldname / pattern / replacement triplets, like @gsub. Then run the section of code from the register function that generates @gsub\_parsed.
In the code option run the code from the gsub function of a mutate filter.
---
### Author:  [@aap323](https://discuss.elastic.co/u/aap323)
#### Post date: [April 12, 2021, 7:55pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922/5 "2021-04-12T19:55:42Z")
Yeah that sounds like a good idea. Assuming my list of replacements isn't too long I will repurpose this and outsource the replacement hash to another file. Thanks again.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2021, 7:56pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922/6 "2021-05-10T19:56:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.