# How to remove Last Character from message

**URL:** <https://discuss.elastic.co/t/how-to-remove-last-character-from-message/153285>\
**Category:** Logstash\
**Created:** [October 21, 2018, 12:52pm UTC](https://discuss.elastic.co/t/how-to-remove-last-character-from-message/153285 "2018-10-21T12:52:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![syedmujtaba88](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@syedmujtaba88](https://discuss.elastic.co/u/syedmujtaba88)\
**Post date:** [October 21, 2018, 12:52pm UTC](https://discuss.elastic.co/t/how-to-remove-last-character-from-message/153285/1 "2018-10-21T12:52:01Z")

</div>

i have a log like below for which i can successfully apply a grok pattern and decode the data to field.

#### \<request\_type\> \<\> \<\> **\< SOAP-** \<XML\_DATA\>\>

however my requirement is to capture the complete \<XML\_DATA\> into %{greedydata} but am having difficulty in handling the last character "\>" which is enclosure of **\< SOAP-** wrapper but not part of XML.

is there a way i can delete this last character from my message or using some other filter (on fields) after parsing the log to fields (using grok)

thanks.

---

<div class="post-metadata">

**Author:** ![syedmujtaba88](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@syedmujtaba88](https://discuss.elastic.co/u/syedmujtaba88)\
**Post date:** [October 21, 2018, 4:52pm UTC](https://discuss.elastic.co/t/how-to-remove-last-character-from-message/153285/2 "2018-10-21T16:52:25Z")

</div>

Found the answer:

mutate {  
gsub =\> ["", ".{1}$", ""]  
}

thanks to everyone who has tried.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2018, 4:52pm UTC](https://discuss.elastic.co/t/how-to-remove-last-character-from-message/153285/3 "2018-11-18T16:52:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.