How to remove Last Character from message

Elastic Stack Logstash
1

i have a log like below for which i can successfully apply a grok pattern and decode the data to field.

#### <request_type> <> <> < SOAP- <XML_DATA>>

however my requirement is to capture the complete <XML_DATA> into %{greedydata} but am having difficulty in handling the last character ">" which is enclosure of < SOAP- wrapper but not part of XML.

is there a way i can delete this last character from my message or using some other filter (on fields) after parsing the log to fields (using grok)

thanks.

2

Found the answer:

mutate {
gsub => [ "", ".{1}$", "" ]
}

thanks to everyone who has tried.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.