Split text field - keep only the second part (noob)

(Charalampos Konstantinidis) #1


My text field is in this form AAA_ΒΒΒ.

I used the split filter
split => [ "message" , "_" ]

and the result is
message AAA, BBB

and now I want to delete AAA from message.
any ideas?


(Charalampos Konstantinidis) #2

found it a few minutes after my post here, I used dissect


This should also do it:

    split => [ "message" , "_" ]
    mutate {
      replace => { “message” => “%{[message][1]}”

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.