title: How do I replace a string in a field in Logstash
body: <p>I have an IP address field from the Windows event log that contains characters like "::fffff:" in front of the IP address. I cannot change the source here, so I have to fix this in Logstash.</p>
  
  <p>I must suck at googling, but I really can't find a simple way to just strip these characters from the ip-address fields in logstash.</p>
  
  <p>I have tried for example</p>
  
  <pre><code> if ("" in [event_data][IpAddress]) {
          mutate {
                add_field =&gt; { "client-host" =&gt; "%{[event_data][IpAddress]}"}
                gsub =&gt; ["client-host", ":", ""]
          }
          dns {
               action =&gt; "replace"
               reverse =&gt; [ "client-host" ]
          }
   }
  </code></pre>
  
  <p>but no luck, the colon is still there. How can I replace "::ffff:" in the string "::ffff:10.0.36.39" in Logstash?</p>