Type to search.

Replace processor

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack 9.3+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.3

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Replace processor replaces portions of a string field that match a regular expression with a replacement string.

To use the Replace processor:

  1. Select Create → Create processor.
  2. Select Replace from the Processor menu.
  3. Set the Source Field to the field that contains the string you want to replace.
  4. Set the Pattern to the regular expression or text that you want to replace.
  5. Set the Replacement to the value that will replace the portion of the string matching your pattern. Replacements can be text, an empty value, or a capture group reference.

This functionality uses the Elasticsearch Gsub processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

In YAML mode, configure the replace processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter Type Required Description
from string Yes Source field containing the string.
pattern string Yes Regular expression pattern to match (Java regex).
replacement string Yes Replacement string. Supports capture group references (for example, $1, $2).
to string No Target field for the result. Defaults to the source field.
ignore_missing boolean No When true, skip this processor if the source field is missing.
YAML 
- action: replace
  from: attributes.email
  pattern: "(\\w+)@(\\w+\\.\\w+)"
  replacement: "***@$2"