SEDCMD trouble- How to delete vfwew from field account?

[bosseres]

Hello everyone!

I'm trying to make props file which will trim all not cyrillic symbols from field "account"

My log example is 

18:10:24 Object="some object" Source="some source1323" Account="Аккаунтvfweцw"

i want to delete vfwew from field Account, but note that symbols can go in any order and with cyrillic symbols too, i need to catch them all and delete, only from one field

SEDCMD-notcyr - Account="....

[PickleRick]

There is no way to do it with just a SEDCMD. The y command would match character class anywhere in the event and with s command you can't either restrict matching to a specific field (there is no notion of fields at this point at all) or match (for substitution) a string with holes in it.

[Gr0und_Z3r0]

hi @bosseres 

Try something like this...

| makeresults 
| eval Account="Аккаунтvfweцw"
| rex field=Account mode=sed "s/[^А-Яа-я]+//g"
| table Account

~ If the reply helps, a Karma upvote would be appreciated