How to remove Last Character from message

[syedmujtaba88 (Syed Mujtaba Ali)]

i have a log like below for which i can successfully apply a grok pattern and decode the data to field.

#### <request_type> <> <> < SOAP- <XML_DATA>>

however my requirement is to capture the complete <XML_DATA> into %{greedydata} but am having difficulty in handling the last character ">" which is enclosure of < SOAP- wrapper but not part of XML.

is there a way i can delete this last character from my message or using some other filter (on fields) after parsing the log to fields (using grok)

thanks.

[syedmujtaba88 (Syed Mujtaba Ali)]

Found the answer:

mutate {
gsub => [ "", ".{1}$", "" ]
}

thanks to everyone who has tried.