# Remove everything up to -\>

**URL:** <https://discuss.elastic.co/t/remove-everything-up-to/312623>\
**Category:** Logstash\
**Created:** [August 22, 2022, 12:54pm UTC](https://discuss.elastic.co/t/remove-everything-up-to/312623 "2022-08-22T12:54:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ombit](https://avatars.discourse-cdn.com/v4/letter/o/ea5d25/32.png) [@ombit](https://discuss.elastic.co/u/ombit)\
**Post date:** [August 22, 2022, 12:54pm UTC](https://discuss.elastic.co/t/remove-everything-up-to/312623/1 "2022-08-22T12:54:16Z")

</div>

Hi all,

I have a log that is created from various different source servers. Using Wazuh, each item is forwarded to this one log which is then intended to go off to a remote QRADAR server.

Wazuh is adding its own part to the log and I've managed to create a conf file that removes everything that logstash and filebeat adds which gets me to this:

{"message":"2022 Aug 05 07:45:43 logServer01-\>192.22.0.5 Aug 05 2022 07:45:43 FIREWALL01 : %ASA-6-302020: Built inbound ICMP connection for faddr 172.10.123.456/24592 gaddr 172.10.132.456/0 laddr 172.10.123.186/0 type 8 code 0 "}

My problem is that the QRADAR server will still see this log entry as coming from logserver01 and not as though it's coming from 192.22.0.5 ie Firewall01. If I could delete everything before and including -\> I think I should be on the right path. Could one of you geniuses advise me on how to achieve that please?

My conf file looks like this:

```auto

input {
   beats {
        port => "5044"
# type => "log"
        }
}
filter {

   date {
      match => ['syslog_timestamp', 'ISO8601']
      remove_field => ['syslog_timestamp']
    }
   mutate {
       remove_field => [ "log.level", "@timestamp", "log.logger", "ecs", "log", "path", "tags", "@version", "input", "agent", "type", "name", "event", $

     }
# if [type] == "syslog" {
# grok {
# match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log-level} \[%{DATA:class}\]:%{GREEDYDATA:message}" }
# }
# }
}

output {
        file {
         path => "/tmp/testfile.log"
        }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 22, 2022, 1:21pm UTC](https://discuss.elastic.co/t/remove-everything-up-to/312623/2 "2022-08-22T13:21:42Z")

</div>

You could use a `dissect` filter.

```auto
dissect {
    mapping => {
        "message" => "%{}->%{message}"
    }
}

```

It will ignore everything that is before the `->` and store everything that is after in the `message` field, overriding the original `message` field.

---

<div class="post-metadata">

**Author:** ![ombit](https://avatars.discourse-cdn.com/v4/letter/o/ea5d25/32.png) [@ombit](https://discuss.elastic.co/u/ombit)\
**Post date:** [August 22, 2022, 4:21pm UTC](https://discuss.elastic.co/t/remove-everything-up-to/312623/3 "2022-08-22T16:21:00Z")

</div>

Many thanks. It works a treat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2022, 4:21pm UTC](https://discuss.elastic.co/t/remove-everything-up-to/312623/4 "2022-09-19T16:21:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.