How to truncate a field or limit a field value

ethanthomas — Thu, 08 Jul 2021 15:02:13 GMT

I have a field called org_name in the data as below

Org_name="davidcareerhome"

Org_name ="Ethanfurniture"

I want to limit the Org_name only for the first three bytes as below

Org_name="dav"

Org_name="Eth"

Can someone help me with this and how to do make this change in props.conf and the regex for the same ?

Re: How to truncate a field or limit a field value

richgalloway — Thu, 08 Jul 2021 16:44:23 GMT

Use the substr function.

... | eval Org_name=substr(Org_name, 1, 3)