# Update/rewrite the value in a field?

**URL:** <https://discuss.elastic.co/t/update-rewrite-the-value-in-a-field/81250>\
**Category:** Logstash\
**Created:** [April 5, 2017, 5:06am UTC](https://discuss.elastic.co/t/update-rewrite-the-value-in-a-field/81250 "2017-04-05T05:06:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [April 5, 2017, 5:06am UTC](https://discuss.elastic.co/t/update-rewrite-the-value-in-a-field/81250/1 "2017-04-05T05:06:58Z")

</div>

I have a log that has the pattern similar to the following in a field called `host`:

```auto
ip-x-x-x-x.us-west-2.compute.internal

```

I'm wondering if there is a good way to apply a regex to the value in the field so I obtain just the IP address, like `x.x.x.x`. Is this supported?

I was looking at `mutate` but I'm not seeing a way to apply a regex to the value of a field to update it. Is this possible or is there another good way to accomplish this that I'm not seeing?

EDIT: I think I have the regex I need, just trying to figure out how to apply it to a field.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 5, 2017, 6:00am UTC](https://discuss.elastic.co/t/update-rewrite-the-value-in-a-field/81250/2 "2017-04-05T06:00:31Z")

</div>

You can use the grok filter to do regex processing on fields.

---

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [April 5, 2017, 5:29pm UTC](https://discuss.elastic.co/t/update-rewrite-the-value-in-a-field/81250/3 "2017-04-05T17:29:36Z")

</div>

Derp. That was it, thanks @Christian_Dahlqvist.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2017, 5:29pm UTC](https://discuss.elastic.co/t/update-rewrite-the-value-in-a-field/81250/4 "2017-05-03T17:29:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.