topic Re: How to discard extra text from a single line in events? in Getting Data In

How to discard extra text from a single line in events?

Kumar2 — Mon, 06 Dec 2021 10:35:39 GMT

Example: Mynameissachintendulkar .Except sachin I need to remove remaining all text .please help me with the query. Thanks in Advance

gcusello — Mon, 06 Dec 2021 10:40:23 GMT

what do you mean with "discard"?

are you speaking of discard before indexing or discard at search time?

Could you share some sample of your logs?

Ciao.

Giuseppe

Kumar2 — Mon, 06 Dec 2021 10:45:43 GMT

Discard at the Search time sir

gcusello — Mon, 06 Dec 2021 11:06:05 GMT

if you have a rule for the not displaying part (e.g. all after Except), you could create a regex like this:

| rex "^(?<part_to_display>.*)Except"

to extract the part of _raw to display.

If you could share some sample I could help you more.

Ciao.

Giuseppe

Kumar2 — Mon, 06 Dec 2021 11:23:04 GMT

Eg: mynameisgautamkrishna .after extracting name=gautam .now I have to Delete everything Except Gautam and only name (Gautam) will display in events

mynameisgautamkrishna

After Ingest and Extract Name=Gautam

Gautam should display in Events as well as in corresponding Interesting field (Name)

gcusello — Mon, 06 Dec 2021 11:30:33 GMT

you have to identify a rule to extract the field to display: e.g. take all after "mynameis".

In your sample, it's easy to understand where the field sarts but it's difficoult to understand where the field finishes:

| rex "mynameis(?<name>\w+)"

if the number of chars is fixed (e.g. 8), you could use something like this

| rex "mynameis(?<name>\w{8})"

Ciao.

Giuseppe