# Remove part of a field

**URL:** https://discuss.elastic.co/t/remove-part-of-a-field/51043
**Category:** Logstash
**Created:** [May 26, 2016, 10:29am UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043 "2016-05-26T10:29:35Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [May 26, 2016, 10:29am UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043/1 "2016-05-26T10:29:35Z")

</div>

Hi,

I'm working with phone numbers, i would like to save the 2 or 3 first digit of a phone number ( international code) .

Actually i have a field "called\_number", how can i save the 2 or 3 first digit in another field ? some country have 2 digit, some others have 3 digits.

Thx

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 26, 2016, 10:38am UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043/2 "2016-05-26T10:38:33Z")

</div>

Use a grok filter to extract the first few digits.

---

<div class="post-metadata">

### Author: ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [May 26, 2016, 11:29am UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043/3 "2016-05-26T11:29:41Z")

</div>

could you help me to built that grok ?

---

<div class="post-metadata">

### Author: ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [May 26, 2016, 12:58pm UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043/4 "2016-05-26T12:58:34Z")

</div>

I just discover that some country prefix has 1 digit, 2 digit, 3 digit or 6 digit.

i would like to base on that tutorial: [http://www.sanjeevnandam.com/blog/logstash-convert-zipcodepostal-code-to-geo\_point-latitudelongitude](http://www.sanjeevnandam.com/blog/logstash-convert-zipcodepostal-code-to-geo_point-latitudelongitude)

but i suppose a have do do multiple check ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043/5 "2017-07-06T04:56:05Z")

</div>


