# Remove some parts in the middle of a string

**URL:** <https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305>\
**Category:** Logstash\
**Created:** [March 3, 2017, 11:32am UTC](https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305 "2017-03-03T11:32:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![guenther](https://avatars.discourse-cdn.com/v4/letter/g/e36b37/32.png) [@guenther](https://discuss.elastic.co/u/guenther)\
**Post date:** [March 3, 2017, 11:32am UTC](https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305/1 "2017-03-03T11:32:53Z")

</div>

Hi,

we have the problems, that some errors (stackTraces) get really long.  
In such cases, we get the error

`Document contains at least one immense term in field=\"exception.stackTrace\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms`

We are not willing to not-analyse the filed because it is quite important. But what can be said is, that usual the middle part is not very interesting. Just the beginning and the end.

So it would be great if I can say: First 15.000 bytes + "..." + the last 15.000 bytes.  
So just shorten the stackTrace in the uninteresting middle.

Is this somehow possible?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 6, 2017, 11:05am UTC](https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305/2 "2017-03-06T11:05:09Z")

</div>

You might be able to use a mutate filter's gsub option, but you can definitely use a ruby filter to do this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2017, 11:05am UTC](https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305/3 "2017-04-03T11:05:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.