Remove contents of field from another field


Hello there,

I need to remove the contents of some field from another field.
This seems like an easy procedure, but sadly I couldn't get it to work.
This is what I tried, but it didn't work:

mutate {
gsub => ["message", [removethis], ""]

:arrow_right: Replace all the things in "message" matching with the contents of field "removethis" with "".

Essentially what I am looking for is something that can do this:

Field [message] = "Hello, I am Bob"
Field [removethis] = "Bob"


Field [message] after filter= "Hello, I am "

I hope you can help me. :sunglasses:

(Magnus Bäck) #2

Have you tried

gsub => ["message", "%{removethis}", ""]



Yep, that's it.
Thank you!
Sometimes it's that simple :grin:

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.