Split text field - keep only the second part (noob)


(Charalampos Konstantinidis) #1

Hello

My text field is in this form AAA_ΒΒΒ.

I used the split filter
split => [ "message" , "_" ]

and the result is
message AAA, BBB

and now I want to delete AAA from message.
any ideas?

thanks,


(Charalampos Konstantinidis) #2

found it a few minutes after my post here, I used dissect


#3

This should also do it:

    split => [ "message" , "_" ]
    mutate {
      replace => { “message” => “%{[message][1]}”
    }

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.