# Any idea?

**URL:** <https://discuss.elastic.co/t/any-idea/85032>\
**Category:** Logstash\
**Created:** [May 9, 2017, 8:06am UTC](https://discuss.elastic.co/t/any-idea/85032 "2017-05-09T08:06:02Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 8:06am UTC](https://discuss.elastic.co/t/any-idea/85032/1 "2017-05-09T08:06:02Z")

</div>

Hello guys,  
I had specific log like that:  
Fri Mar 18 14:06:17 2016 DISCONNECT C2075/2319 host 192.168.44.1/32949 (192.168.44.1)  
Fri Mar 18 14:06:17 2016 DISCONNECT C610/3117 host 192.168.44.1/24080 (192.168.44.1)  
Fri Mar 18 14:06:17 2016 CONNECT FROM C3118/- host 192.168.44.1/51345  
Fri Mar 18 14:06:17 2016 CONNECT TO S3118/611 host 194.39.131.34/sapdp99 (194.39.131.34)

I would delete the word "host", Did you think it's possible in the filter ?

---

<div class="post-metadata">

**Author:** ![bertvervaele](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)\
**Post date:** [May 9, 2017, 8:10am UTC](https://discuss.elastic.co/t/any-idea/85032/2 "2017-05-09T08:10:50Z")

</div>

```
filter {
  if [message] =~ "host" {
    drop { }
  }
}

```

Or if you are on linux just run the command "sed '/host/d' filename"

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 8:17am UTC](https://discuss.elastic.co/t/any-idea/85032/3 "2017-05-09T08:17:45Z")

</div>

Yes , but drop delete host and everything after, I would delete only "host"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 9, 2017, 8:18am UTC](https://discuss.elastic.co/t/any-idea/85032/4 "2017-05-09T08:18:28Z")

</div>

Use the mutate filter and its gsub option to replace "host" with an empty string.

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 8:19am UTC](https://discuss.elastic.co/t/any-idea/85032/5 "2017-05-09T08:19:06Z")

</div>

Okay, I will try it 🙂

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 8:33am UTC](https://discuss.elastic.co/t/any-idea/85032/6 "2017-05-09T08:33:45Z")

</div>

I test with that, and it doesn't work , did I do a mistake ?

filter {  
if "disconnect" in [tags] {  
mutate {  
gsub =\> [  
"test", " host ", "."  
]  
}

PS: My tag works

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 9, 2017, 8:38am UTC](https://discuss.elastic.co/t/any-idea/85032/7 "2017-05-09T08:38:10Z")

</div>

Please show us an example event where it didn't work. Use a `stdout { codec => rubydebug }` output or copy/paste from the JSON tab in Kibana.

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 8:40am UTC](https://discuss.elastic.co/t/any-idea/85032/8 "2017-05-09T08:40:39Z")

</div>

I test with logstash -f , I can only show you a screenshot 😕

 ![](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8c48a55c963d50e69565db814d896746b01b4bb.png)

I want to delete the word "host" because i want take the session (C2362/2980) and the IP with the port.  
I can take the IP/port and the session , but not together because there is the word host who block the match

---

<div class="post-metadata">

**Author:** ![bertvervaele](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)\
**Post date:** [May 9, 2017, 8:53am UTC](https://discuss.elastic.co/t/any-idea/85032/9 "2017-05-09T08:53:51Z")

</div>

```
filter {
   if "disconnect" in [tags] {
      mutate {
         gsub => [
            "message", " host ", "."
         ]
       }
   }

```

I think you use gsub on the wrong field

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 8:56am UTC](https://discuss.elastic.co/t/any-idea/85032/10 "2017-05-09T08:56:24Z")

</div>

Nice , thank you it works 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 9, 2017, 9:03am UTC](https://discuss.elastic.co/t/any-idea/85032/11 "2017-05-09T09:03:06Z")

</div>

> I test with logstash -f , I can only show you a screenshot

I'm quite sure that your terminal window allows you to select text and copy it so that you can paste it into a tab in your web browser.

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 9, 2017, 9:04am UTC](https://discuss.elastic.co/t/any-idea/85032/12 "2017-05-09T09:04:49Z")

</div>

Ah , yes but i think you want only a json file 😕

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 9:16am UTC](https://discuss.elastic.co/t/any-idea/85032/13 "2017-06-06T09:16:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.