# Keep a concrete character regular expressioon

**URL:** <https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696>\
**Category:** Logstash\
**Created:** [September 21, 2021, 9:03am UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696 "2021-09-21T09:03:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [September 21, 2021, 9:03am UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696/1 "2021-09-21T09:03:44Z")

</div>

i need to keep only two characters of a field but i dont know how to do it.

I would like to keep the second and third character of the server name, which indicates the country code, for example T52EDFS011 (52).  
i'm new with regular expressions....

Thanks in advanced!

---

<div class="post-metadata">

**Author:** ![Sandeep\_Raju](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Post date:** [September 21, 2021, 9:55am UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696/2 "2021-09-21T09:55:14Z")

</div>

One way it can be achieved in Kibana is by; using **static lookup** in the field in giving country codes for each value.

---

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [September 21, 2021, 1:44pm UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696/3 "2021-09-21T13:44:54Z")

</div>

thank you, finally i can doit with this:

"\S(?.{2}).\*"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2021, 1:45pm UTC](https://discuss.elastic.co/t/keep-a-concrete-character-regular-expressioon/284696/4 "2021-10-19T13:45:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.