# Logstash substring a field using position
**URL:** https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569
**Category:** Logstash
**Created:** [October 20, 2015, 12:47pm UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569 "2015-10-20T12:47:55Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@samnik60](https://discuss.elastic.co/u/samnik60)
#### Post date: [October 20, 2015, 12:47pm UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/1 "2015-10-20T12:47:55Z")
hi guys,
if i want to extract first 3 characters from a field, how do i go about it.
Thanks,
sam
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 20, 2015, 2:38pm UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/2 "2015-10-20T14:38:51Z")
I think you need a ruby filter.
```
ruby {
code => "event['dest-field'] = event['src-field'][0..2]"
}
```
---
### Author:  [@samnik60](https://discuss.elastic.co/u/samnik60)
#### Post date: [October 21, 2015, 10:52am UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/3 "2015-10-21T10:52:14Z")
> [@magnusbaeck](#):
>
> ruby {
> code =\> "event['dest-field'] = event['src-field'][0..2]"
> }
works thanks a lot. I am trying out logstash for the first time, have many more questions 😄
---
### Author:  [@Kvin](https://discuss.elastic.co/u/Kvin)
#### Post date: [April 10, 2017, 11:50am UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/4 "2017-04-10T11:50:00Z")
This is, indeed, a good solution and worked for me, but not anymore in 5.X.
How's "event['src-field'][0..2]" supposed to look like with the new event API?
[https://www.elastic.co/guide/en/logstash/current/event-api.html](https://www.elastic.co/guide/en/logstash/current/event-api.html)
What's the correct syntax of substring in 5.X?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 10, 2017, 11:52am UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/5 "2017-04-10T11:52:33Z")
```
event.get('src-field')[0..2]
```
---
### Author:  [@Kvin](https://discuss.elastic.co/u/Kvin)
#### Post date: [April 10, 2017, 1:58pm UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/6 "2017-04-10T13:58:44Z")
Thank you very much!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:27am UTC](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569/7 "2017-07-06T04:27:14Z")