# How to get prefix of a string

**URL:** https://discuss.elastic.co/t/how-to-get-prefix-of-a-string/139915
**Category:** Logstash
**Created:** [July 13, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-to-get-prefix-of-a-string/139915 "2018-07-13T09:38:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![vschakka](https://avatars.discourse-cdn.com/v4/letter/v/d07c76/32.png) [@vschakka](https://discuss.elastic.co/u/vschakka)
#### Post date: [July 13, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-to-get-prefix-of-a-string/139915/1 "2018-07-13T09:38:11Z")

</div>

Hi,  
I have a field with value "sv4axmaic04". I need to extract value before "axmaic". But substring "axmaic" is same/constant across all the field values. So I just need to extract value "sv4" from the given example.

Can I use dissect as below: Or any other better way  
dissect {  
mapping =\> {  
"message" =\> "%{field1}axmaic%{field2}"  
}  
}

But i don't want field2 getting created here.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 13, 2018, 2:46pm UTC](https://discuss.elastic.co/t/how-to-get-prefix-of-a-string/139915/2 "2018-07-13T14:46:59Z")

</div>

If you do not want field2 created then do not give it a name, just use %{}.

Another option would be to use a regexp to match the first three characters of the field

```
grok { match => { "message" => "^(?<field1>...)" } }
```

---

<div class="post-metadata">

### Author: ![vschakka](https://avatars.discourse-cdn.com/v4/letter/v/d07c76/32.png) [@vschakka](https://discuss.elastic.co/u/vschakka)
#### Post date: [July 16, 2018, 9:02am UTC](https://discuss.elastic.co/t/how-to-get-prefix-of-a-string/139915/3 "2018-07-16T09:02:14Z")

</div>

Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 13, 2018, 9:02am UTC](https://discuss.elastic.co/t/how-to-get-prefix-of-a-string/139915/4 "2018-08-13T09:02:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
