[[replace-fields]]
=== Replace fields from events

++++
<titleabbrev>replace</titleabbrev>
++++

The `replace` processor takes a list of fields to replace the field value 
matching a pattern with replacement string. Under the `fields` key, each entry 
contains a `field: field-name`, `pattern: regex-pattern` and 
`replacement: replacement-string`, where:

* `field` is the original field name
* `pattern` is the regex pattern to match the field's value
* `replacement` is the replacement string to use to update the field's value

The `replace` processor cannot be used to replace value with a completely new value. 

TIP: The `replacement` field value can be used to truncate the `field` value or replace
it with a new string. It can also be used for masking PII information.

The following example will change path from /usr/bin to /usr/local/bin:

[source,yaml]
-------
processors:
  - replace:
      fields:
        - field: "file.path"
          pattern: "/usr/"
          replacement: "/usr/local/"
      ignore_missing: false
      fail_on_error: true
-------

The `replace` processor has following configuration settings:

`ignore_missing`:: (Optional) If set to `true`, no error is logged if the specified field 
is missing. The default is `false`.

`fail_on_error`:: (Optional) If set to `true` and there's an error, the replacement of
field values is stopped and the original event is returned. If set to `false`, replacement
continues even if an error occurs during replacement. The default is `true`.

See <<conditions>> for a list of supported conditions.

You can specify multiple `ignore_missing` processors under the `processors`
section.
