# How to extract this pattern: limited characters from "00205BKR0000CD"

**URL:** https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240
**Category:** Logstash
**Created:** [July 30, 2018, 6:55pm UTC](https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240 "2018-07-30T18:55:17Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)
#### Post date: [July 30, 2018, 6:55pm UTC](https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240/1 "2018-07-30T18:55:17Z")

</div>

Hi All

I have a event/column in below format

> **Column1**  
> 00204VAB0000CD  
> 00204VAB0000CD  
> 00204VAB0000CD  
> 00205BKR0000CD

I want to extract in new column like this

> Column2  
> VAB  
> VAB  
> VAB  
> BKR

This is nothing but the way we do it in excel LEFT(A2,5)

How we can do this with filter, what filter i should use to achieve this.  
I thought about grok filter but not sure how to go about

Thanks

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 30, 2018, 7:03pm UTC](https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240/2 "2018-07-30T19:03:17Z")

</div>

```
grok { match => { "someField" => => "^.....(?<newField>...)" } }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2018, 7:03pm UTC](https://discuss.elastic.co/t/how-to-extract-this-pattern-limited-characters-from-00205bkr0000cd/142240/3 "2018-08-27T19:03:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.