KV trim_key or remove_char_key

[ctaroco]

Hi,

I'm receiving syslogs from different equipment with quite different formats, but every log always starts with something like this:

<188>time=..... or <177>id=.....

So, each time that I apply kv, I got a field named like: <188>time, <187>time and so on.

I would like to trim o remove this part of the field, but a couldn't find a way to write in the conf file an expression to solved it. The result always is that only the first "<" get removed.

Any thoughts?

[magnusbaeck (Magnus Bäck)]

Use a grok filter to preprocess each log line and extract everything that comes after the prefix to a new field that you feed to kv. Or, use a mutate filter's gsub option to replace the prefix with an empty string.