# GROK - how to strip first five and last four characters from the field

**URL:** https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689
**Category:** Logstash
**Created:** [July 10, 2019, 8:30am UTC](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689 "2019-07-10T08:30:05Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![mudricd](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@mudricd](https://discuss.elastic.co/u/mudricd)
#### Post date: [July 10, 2019, 8:30am UTC](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689/1 "2019-07-10T08:30:05Z")

</div>

Hi,

I am trying to strip first five and last four characters from the log.

This is the log:

// "7AFA267A-E3C5-753F-DF422B36C7D07B80 - func\_doTopup.cfm: 87 ms"  
"7AFA267A-E3C5-753F-DF422B36C7D07B80 - func\_doTopup.cfm: 7400 ms"  
"7B1EDF03-A296-3F15-B5E91CBDAF9E8306 - SendWaitingSMS\_auto: 171 ms"  
"7B1EDF03-A296-3F15-B5E91CBDAF9E8306 - SendWaitingSMS\_auto: 26 ms"  
"7B1EDF03-A296-3F15-B5E91CBDAF9E8306 - SendWaitingSMS\_auto: 30 ms"  
"7B1EE995-CE33-D2C5-E33722B7A9B52811 - func\_doTopup.cfm: 94 ms"  
"7B1EE995-CE33-D2C5-E33722B7A9B52811 - func\_doTopup.cfm: 7207 ms"  
"7B2473D6-0182-9BAB-8D64A64421411B10 - func\_setBar.cfm: 434 ms"  
"7B2473D6-0182-9BAB-8D64A64421411B10 - func\_setBar.cfm: 41 ms"

Here is the patter I was using:

// (?%{WORD}-%{WORD}-%{WORD}-%{WORD})\s+-\s+(?%{NOTSPACE})\s+(?\<execution\_time\>%{INT})\s+%{WORD:unit}

The part that I am tryng to fix is (?%{NOTSPACE}). The field I got is func\_doTopup.cfm: but I would like it to be doTopup.

Any help would be much appreciated!

Cheers

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 10, 2019, 2:08pm UTC](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689/2 "2019-07-10T14:08:24Z")

</div>

> [@mudricd](#):
>
> The field I got is func\_doTopup.cfm: but I would like it to be doTopup.

If you want to strip the specific characters \_fund and .cfm then use

```
    mutate { gsub => ["someField", "^func_", "", "someField", "\.cfm$", ""] }

```

If you really want to strip the first five and last four then use

```
    mutate { gsub => ["someField", "^.....", "", "someField", "....$", ""] }

```

---

<div class="post-metadata">

### Author: ![mudricd](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@mudricd](https://discuss.elastic.co/u/mudricd)
#### Post date: [July 11, 2019, 2:35am UTC](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689/3 "2019-07-11T02:35:46Z")

</div>

@Badger Thanks for the tip mate.

First way didn't work well for me but second one did the trick. This is what I did to get desired result:

` mutate {
                      gsub => ["function", "^.....", "", "function", ".....$", ""]
                 } `

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 8, 2019, 2:35am UTC](https://discuss.elastic.co/t/grok-how-to-strip-first-five-and-last-four-characters-from-the-field/189689/4 "2019-08-08T02:35:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.