# KV trim\_key or remove\_char\_key
**URL:** https://discuss.elastic.co/t/kv-trim-key-or-remove-char-key/104304
**Category:** Logstash
**Created:** [October 17, 2017, 8:23pm UTC](https://discuss.elastic.co/t/kv-trim-key-or-remove-char-key/104304 "2017-10-17T20:23:33Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ctaroco](https://discuss.elastic.co/u/ctaroco)
#### Post date: [October 17, 2017, 8:23pm UTC](https://discuss.elastic.co/t/kv-trim-key-or-remove-char-key/104304/1 "2017-10-17T20:23:33Z")
Hi,
I'm receiving syslogs from different equipment with quite different formats, but every log always starts with something like this:
\<188\>time=..... or \<177\>id=.....
So, each time that I apply kv, I got a field named like: \<188\>time, \<187\>time and so on.
I would like to trim o remove this part of the field, but a couldn't find a way to write in the conf file an expression to solved it. The result always is that only the first "\<" get removed.
Any thoughts?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 18, 2017, 5:19am UTC](https://discuss.elastic.co/t/kv-trim-key-or-remove-char-key/104304/2 "2017-10-18T05:19:42Z")
Use a grok filter to preprocess each log line and extract everything that comes after the prefix to a new field that you feed to kv. Or, use a mutate filter's gsub option to replace the prefix with an empty string.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2017, 5:20am UTC](https://discuss.elastic.co/t/kv-trim-key-or-remove-char-key/104304/3 "2017-11-15T05:20:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.