# Remove N leading bytes from TCP input

**URL:** https://discuss.elastic.co/t/remove-n-leading-bytes-from-tcp-input/348650
**Category:** Logstash
**Created:** [December 5, 2023, 2:29pm UTC](https://discuss.elastic.co/t/remove-n-leading-bytes-from-tcp-input/348650 "2023-12-05T14:29:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rcz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcz/32/59428_2.png) [@rcz](https://discuss.elastic.co/u/rcz)
#### Post date: [December 5, 2023, 2:29pm UTC](https://discuss.elastic.co/t/remove-n-leading-bytes-from-tcp-input/348650/1 "2023-12-05T14:29:03Z")

</div>

Hi,

We are receiving some dubious Protobuf-encoded messages on our TCP input.  
The sender is leading with a custom length-header of 4 bytes.

If we manually dissect the messages, remove the first 4 bytes, and then give them to the input plugin with a protobuf codec, it works.  
So, we want to receive the message in one pipeline, remove the first 4 bytes, and then pass them on to the regular protobuf-decoding pipeline.

Is the Ruby filter the correct way to do this?

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2024, 2:29pm UTC](https://discuss.elastic.co/t/remove-n-leading-bytes-from-tcp-input/348650/2 "2024-01-02T14:29:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.