# Upgrade to 5.5.1 = gsub fails?

**URL:** <https://discuss.elastic.co/t/upgrade-to-5-5-1-gsub-fails/94534>\
**Category:** Logstash\
**Created:** [July 25, 2017, 7:44pm UTC](https://discuss.elastic.co/t/upgrade-to-5-5-1-gsub-fails/94534 "2017-07-25T19:44:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [July 25, 2017, 7:44pm UTC](https://discuss.elastic.co/t/upgrade-to-5-5-1-gsub-fails/94534/1 "2017-07-25T19:44:35Z")

</div>

Hi,

While I'm not seeing any errors when doing a config check, my gsub that did work to strip down usernames is not no longer firing. Can't figure out why. It worked fine in 5.0.0.

So I use the following to simply strip out everything before the \ of a username so MY\_DESTOP\_PC\Joe.Bloggs becomes "Joe Bloggs".  
The code:

```
mutate {
    	gsub => ["UserName", "^(.*)[\\]", "" ]
}

```

Any ideas as to why this results in the username field ending up still showing as MY\_DESTOP\_PC\Joe.Bloggs?

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 26, 2017, 7:56am UTC](https://discuss.elastic.co/t/upgrade-to-5-5-1-gsub-fails/94534/2 "2017-07-26T07:56:13Z")

</div>

I can't reproduce.

```nohighlight
$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  mutate {
    gsub => ["message", "^(.*)[\\]", "" ]
  }
}
$ echo 'MY_DESTOP_PC\Joe.Bloggs' | ~/logstash/logstash-5.5.1/bin/logstash -f test.config
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
Sending Logstash's logs to /home/magnus/logstash/logstash-5.5.1/logs which is now configured via log4j2.properties
[2017-07-26T09:55:11,891][INFO][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/home/magnus/logstash/logstash-5.5.1/data/queue"}
[2017-07-26T09:55:11,895][INFO][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/home/magnus/logstash/logstash-5.5.1/data/dead_letter_queue"}
[2017-07-26T09:55:11,915][INFO][logstash.agent] No persistent UUID file found. Generating new UUID {:uuid=>"6a52ce38-5d7a-4616-bcc1-d6ca4e6a4ec8", :path=>"/home/magnus/logstash/logstash-5.5.1/data/uuid"}
[2017-07-26T09:55:12,141][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
[2017-07-26T09:55:12,155][INFO][logstash.pipeline] Pipeline main started
[2017-07-26T09:55:12,199][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
{
    "@timestamp" => 2017-07-26T07:55:12.181Z,
      "@version" => "1",
          "host" => "bertie",
       "message" => "Joe.Bloggs"
}
[2017-07-26T09:55:15,167][WARN][logstash.agent] stopping pipeline {:id=>"main"}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2017, 7:56am UTC](https://discuss.elastic.co/t/upgrade-to-5-5-1-gsub-fails/94534/3 "2017-08-23T07:56:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.