Help with gsub in mutate heading chars

Elastic Stack Logstash
1

Hi,
I need to substract the headding 00 in some fields.
I have tried something like

mutate {
            gsub => [
                "from", "[\A00\d+]", "??????"
        ]

}

what do I have to put in the ??? in order to have the remaining digits?

Thank you
Reagrds
Ana

2

I think it is solved

        gsub => [
                "from", "(\A00)(\d+)", "\2"
        ]

Regards

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.