---
title: Replace processor
description: The Replace processor replaces portions of a string field that match a regular expression with a replacement string. To use the Replace processor: Select...
url: https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract/replace
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.3
---

# Replace processor
The **Replace** processor replaces portions of a string field that match a regular expression with a replacement string.
To use the **Replace** processor:
1. Select **Create** → **Create processor**.
2. Select **Replace** from the **Processor** menu.
3. Set the **Source Field** to the field that contains the string you want to replace.
4. Set the **Pattern** to the regular expression or text that you want to replace.
5. Set the **Replacement** to the value that will replace the portion of the string matching your pattern. Replacements can be text, an empty value, or a capture group reference.

This functionality uses the Elasticsearch [Gsub processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/enrich-processor/gsub-processor) internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to [Processor limitations and inconsistencies](/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract#streams-processor-inconsistencies).

## YAML reference

In [YAML mode](/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract#streams-editing-yaml-mode), configure the replace processor using the following parameters. For the complete Streamlang syntax, refer to the [Streamlang reference](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/streamlang).

| Parameter        | Type    | Required | Description                                                                      |
|------------------|---------|----------|----------------------------------------------------------------------------------|
| `from`           | string  | Yes      | Source field containing the string.                                              |
| `pattern`        | string  | Yes      | Regular expression pattern to match (Java regex).                                |
| `replacement`    | string  | Yes      | Replacement string. Supports capture group references (for example, `$1`, `$2`). |
| `to`             | string  | No       | Target field for the result. Defaults to the source field.                       |
| `ignore_missing` | boolean | No       | When `true`, skip this processor if the source field is missing.                 |

```yaml
- action: replace
  from: attributes.email
  pattern: "(\\w+)@(\\w+\\.\\w+)"
  replacement: "***@$2"
```