topic cut a specific phrase in props.conf in Getting Data In

cut a specific phrase in props.conf

GSNRMUVW — Mon, 02 Feb 2026 19:20:03 GMT

Hi Community,

how to cut...

, "q": 0, "user": "system.user.admin"

...from...

{ "val": 0, "ts": 1770058561014, "q": 0, "user": "system.user.admin" }

...with SEDCMD in props.conf?

This...

[host::iobroker] SEDCMD-remove = s/^, "q": 0, "user": "system.user.admin"$//g

...doesn´t work!

Thank you in advance for your help - Markus

Re: cut a specific phrase in props.conf

richgalloway — Mon, 02 Feb 2026 19:28:29 GMT

You have the right idea, but that regex doesn't work because it's told to expect , "q" at the beginning of the event, which doesn't match the data. Try

SEDCMD-remove = s/, "q": 0, "user": "system.user.admin"//g

Anchor tags (^ and $) are not needed as often as commonly thought.

Re: cut a specific phrase in props.conf

GSNRMUVW — Mon, 02 Feb 2026 19:36:23 GMT

Thank you for your support... but unfortunately, this suggestion does not work, and the entire log continues to be indexed...

Re: cut a specific phrase in props.conf

PickleRick — Mon, 02 Feb 2026 19:52:53 GMT

Unfortunately, you're trying to manipulate structured data with plain regexes. It might work if your jsons are always formatted the same way (which the jsons don't have to be since they rely on logical structure instead of strict formatting or fields order).

If your SEDCMD doesn't work, you're probably not matching the part right with your regex. Maybe it's about other whitespaces than you expect. Or maybe there's another number of those whitespaces.

Check your regex on your real data using https://regex101.com/ - it will show you if it matches or not and you'll be able to debug the regex and see where it fails if it does.

Re: cut a specific phrase in props.conf

GSNRMUVW — Mon, 02 Feb 2026 19:59:21 GMT

Thanks for your suggestion.
I've already tried egex101, but the one that was successfully tested...

/, "q": 0, "user": "system.user.admin"/g

...doesn't work either.

Re: cut a specific phrase in props.conf

PickleRick — Mon, 02 Feb 2026 20:06:09 GMT

OK. That suggests that your SEDCMD is not invoked at all (you could try something obviously right like

SEDCMD-test = s/a/z/g

to verify.

If it indeed doesn't work, that means that either:

1) It's defined in a wrong stanza (a typical mistake here would be attaching it to a host value which is not provided at the beginning of the ingestion pipeline but rather comes from a rewrite in the middle of it).

2) it's set on a wrong component (either on a UF or a heavy component - indexer or HF - which is not the first one in event's path - like an indexer behind a HF).

Re: cut a specific phrase in props.conf

GSNRMUVW — Mon, 02 Feb 2026 20:15:37 GMT

I can rule out both, as other manipulations work.
However, I was happy to carry out your test with the following result:

{ "vzl": 0, "ts": 1770063182265, "q": 0, "user": "system.user.zdmin" }