Split text field - keep only the second part (noob)

Hello

My text field is in this form AAA_ΒΒΒ.

I used the split filter
split => [ "message" , "_" ]

and the result is
message AAA, BBB

and now I want to delete AAA from message.
any ideas?

thanks,

found it a few minutes after my post here, I used dissect

This should also do it:

    split => [ "message" , "_" ]
    mutate {
      replace => { “message” => “%{[message][1]}”
    }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.