# Logstash - REGEX to change a field

**URL:** <https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769>\
**Category:** Logstash\
**Created:** [February 21, 2022, 2:33pm UTC](https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769 "2022-02-21T14:33:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sylvain\_Renard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sylvain_renard/32/97487_2.png) [@Sylvain\_Renard](https://discuss.elastic.co/u/Sylvain_Renard)\
**Post date:** [February 21, 2022, 2:33pm UTC](https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769/1 "2022-02-21T14:33:06Z")

</div>

Hello,

I'm receiving snmptraps from an equipement with a sequence ID at the end. The sequence ID increase at every new trap. This is normaly considered as a new field and after a while the max of field is reached and I can't store no more logs

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b485e84393a08fe82415ed27ad2fec24bf89ef8c.png)

So in my mind, I need to add a filter with a REXGEX code to delete the end of OID (the sequence ID ). Can you let me know how to do that ?

The REGEX should be .[^.]\*$

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 21, 2022, 5:00pm UTC](https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769/2 "2022-02-21T17:00:42Z")

</div>

If you want to change field names using a regexp then you have to use ruby. You could try something like this (not tested):

```
ruby {
    code => '
        event.to_hash { |k, v|
            if k =~ /1\.1\.1/ # I'm sure you can do better than this
                newK = k.sub(/.[^.]+$/)
                event.set(newK, v)
            end
        }
    '
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2022, 5:01pm UTC](https://discuss.elastic.co/t/logstash-regex-to-change-a-field/297769/3 "2022-03-21T17:01:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.