# Using gsub for multi line patterns

**URL:** <https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458>\
**Category:** Logstash\
**Created:** [October 8, 2020, 2:10pm UTC](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458 "2020-10-08T14:10:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Surya\_Iriventi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/surya_iriventi/32/46350_2.png) [@Surya\_Iriventi](https://discuss.elastic.co/u/Surya_Iriventi)\
**Post date:** [October 8, 2020, 2:10pm UTC](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458/1 "2020-10-08T14:10:19Z")

</div>

Hi,  
I am trying to use gsub to remove the prefix for the log line.  
I have a filebeat configuration which matches multiline conguration.  
The multi line log message (input to logstash) would look line this:

```auto
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ start10error	psk.nucleus.ConfigurationException: lazy:/psk/dynamo/service/jdbc/SQL_production
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.nucleus.SimpleComponentState.invokeSetProperty(SimpleComponentState.java:816)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.nucleus.SimpleComponentState$PropertySetterCallback.handleCallback(SimpleComponentState.java:855)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.aop.LazilyResolvedProxyImpl.resolveLazyTarget(LazilyResolvedProxyImpl.java:257)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.aop.LazilyResolvedProxyImpl$1.loadObject(LazilyResolvedProxyImpl.java:110)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.adapter.gsa.GSARepository$$EnhancerByCGLIB$$3bf38308.CGLIB$LOAD_PRIVATE_0(<generated>)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.adapter.gsa.GSARepository$$EnhancerByCGLIB$$3bf38308.getDataSource(<generated>)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.adapter.gsa.GSARepository.doStartService(GSARepository.java:7027)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.nucleus.GenericService.startService(GenericService.java:621)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.nucleus.NucleusNameResolver.startService(NucleusNameResolver.java:1937)
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ at psk.nucleus.NucleusNameResolver.configureAndStartService(NucleusNameResolver.java:1591)

```

which should be transformed to:

```auto
**** Error	Wed Oct 07 02:29:40 UTC 2020	160203778	/ start10error	psk.nucleus.ConfigurationException: lazy:/psk/dynamo/service/jdbc/SQL_production
		at psk.nucleus.SimpleComponentState.invokeSetProperty(SimpleComponentState.java:816)
		at psk.nucleus.SimpleComponentState$PropertySetterCallback.handleCallback(SimpleComponentState.java:855)
		at psk.aop.LazilyResolvedProxyImpl.resolveLazyTarget(LazilyResolvedProxyImpl.java:257)
		at psk.aop.LazilyResolvedProxyImpl$1.loadObject(LazilyResolvedProxyImpl.java:110)
		at psk.adapter.gsa.GSARepository$$EnhancerByCGLIB$$3bf38308.CGLIB$LOAD_PRIVATE_0(<generated>)
		at psk.adapter.gsa.GSARepository$$EnhancerByCGLIB$$3bf38308.getDataSource(<generated>)
		at psk.adapter.gsa.GSARepository.doStartService(GSARepository.java:7027)
		at psk.nucleus.GenericService.startService(GenericService.java:621)
		at psk.nucleus.NucleusNameResolver.startService(NucleusNameResolver.java:1937)
		at psk.nucleus.NucleusNameResolver.configureAndStartService(NucleusNameResolver.java:1591)

```

I am not able to come up with the gsub pattern for this.. Can anybody help  
Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 8, 2020, 4:02pm UTC](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458/2 "2020-10-08T16:02:58Z")

</div>

You could start with

```
mutate { gsub => ["message", "(?!\A)\*\*\*\*[\s0-9a-zA-Z:]+/", " " ] }
```

---

<div class="post-metadata">

**Author:** ![Surya\_Iriventi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/surya_iriventi/32/46350_2.png) [@Surya\_Iriventi](https://discuss.elastic.co/u/Surya_Iriventi)\
**Post date:** [October 9, 2020, 5:26am UTC](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458/3 "2020-10-09T05:26:38Z")

</div>

Hi Badger,  
Thanks for the fast response.  
I was trying to use the default grok patterns in gsub. But came to know. gsub does not support the default grok patterns like %{SPACE} or %{UNIXPATH}. (I wonder why?)

The regex you suggested perfectly worked. Thanks a bunch.  
I just had to tweak it a bit to match any unix like path at the end

```auto
gsub => ["message", "(?!\A)\*\*\*\*[\s0-9a-zA-Z:]+(/([\w_%!$@:.,+~-]+|\\.)*)+", "" ]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2020, 5:26am UTC](https://discuss.elastic.co/t/using-gsub-for-multi-line-patterns/251458/4 "2020-11-06T05:26:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.