Split text field - keep only the second part (noob)

[Charalampos (Charalampos Konstantinidis)]

Hello

My text field is in this form AAA_ΒΒΒ.

I used the split filter
split => [ "message" , "_" ]

and the result is
message AAA, BBB

and now I want to delete AAA from message.
any ideas?

thanks,

[Charalampos (Charalampos Konstantinidis)]

found it a few minutes after my post here, I used dissect

[admlko]

This should also do it:

    split => [ "message" , "_" ]
    mutate {
      replace => { “message” => “%{[message][1]}”
    }