# Use operator with gsub
**URL:** https://discuss.elastic.co/t/use-operator-with-gsub/342111
**Category:** Logstash
**Created:** [September 1, 2023, 10:18am UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111 "2023-09-01T10:18:32Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 1, 2023, 10:18am UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/1 "2023-09-01T10:18:32Z")
Hello,
I need to change a logstash pipeline which use gsub but i've doubt of the syntax
Instead of this
mutate {gsub =\> [
"status", "(?i)added", "plugged"
]}
mutate {gsub =\> [
"status", "(?i)installed", "plugged"
]}
I would like something like this
# mutate {gsub =\> [
```
"status", (added|installed|present|has been restored|inserted|Good|closed|plugged|1|found|connected|inserted|ok),"plugged"
]}
```
But it fails and i think something is missing in my syntax.
Your lights would be helpful
Regards
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 1, 2023, 11:59am UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/2 "2023-09-01T11:59:38Z")
> [@sam1975](#):
>
> But it fails
What fails?
---
### Author:  [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 1, 2023, 12:49pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/3 "2023-09-01T12:49:25Z")
the pipeline crash and the syntax doesn't seem to be good
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 1, 2023, 12:55pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/4 "2023-09-01T12:55:20Z")
What error messages do you get? What does your complete pipeline configuration look like?
---
### Author:  [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 1, 2023, 2:00pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/5 "2023-09-01T14:00:09Z")
I copy an extract of the pipeline
# [START] Map the status value of message to MD syslog return value.
```
# We transform the status into "PLUGGED" or "UNPLUGGED"
mutate {gsub => [
"status", "(?i)added", "plugged"
]}
mutate {gsub => [
"status", "(?i)installed", "plugged"
]}
mutate {gsub => [
"status", "(?i)present", "plugged"
]}
mutate {gsub => [
"status", "(?i)has been restored", "plugged"
]}
mutate {gsub => [
"status", "(?i)removed", "unplugged"
]}
mutate {gsub => [
"status", "(?i)lost", "unplugged"
]}
mutate {gsub => [
"status", "(?i)inserted", "plugged"
]}
mutate {gsub => [
"status", "(?i)not correctly functioning", "unplugged"
]}
mutate {gsub => [
"status", "(?i)no longer present", "unplugged"
]}
mutate {gsub => [
"status", "(?i)Good", "plugged"
]}
mutate {gsub => [
"status", "(?i)Failure", "unplugged"
]}
mutate {gsub => [
"status", "(?i)closed", "plugged"
]}
mutate {gsub => [
"status", "(?i)unlocked and opened", "unplugged"
]}
mutate {gsub => [
"status", "(?i)0", "unplugged"
]}
mutate {gsub => [
"status", "(?i)1", "plugged"
]}
mutate {gsub => [
"status", "(?i)found", "plugged"
]}
mutate {gsub => [
"status", "(?i)Disconnected", "unplugged"
]}
mutate {gsub => [
"status", "(?i)disconnect", "unplugged"
]}
mutate {gsub => [
"status", "(?i)connected", "plugged"
]}
mutate {gsub => [
"status", "(?i)inserted", "plugged"
]}
mutate {gsub => [
"status", "(?i)detected", "unplugged"
]}
mutate {gsub => [
"status", "(?i)ok", "plugged"
]}
mutate {
add_field => {
"syslog_md_text" => "%{physical_location_id}%{physical_location_id_A}%{space}%{physical_location_id_B}|%{vendor_id}|%{dev_id}|%{status}"
}
}
## [END] Formattage syslog_md_text
```
}
}
The problem is that i want to reduce the number of mutate and when i do this
mutate {gsub =\> [
"status", (added|installed|present|has been restored|inserted|Good|closed|plugged|1|found|connected|inserted|ok),"plugged"
]}
the pipeline stop
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 1, 2023, 2:14pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/6 "2023-09-01T14:14:27Z")
> [@sam1975](#):
>
> mutate {gsub =\> [
> "status", (added|installed|present|has been restored|inserted|Good|closed|plugged|1|found|connected|inserted|ok),"plugged"
> ]}
Do you have double quotes around the regexp?
---
### Author:  [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 1, 2023, 2:22pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/7 "2023-09-01T14:22:10Z")
no, i don't have
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 1, 2023, 3:17pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/8 "2023-09-01T15:17:56Z")
Then add double quotes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2023, 3:18pm UTC](https://discuss.elastic.co/t/use-operator-with-gsub/342111/9 "2023-09-29T15:18:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.