remove prefix on every events using SEDCMD

[roopeshetty]

Hi Guys

We are getting logs through syslog with its priority / facility data “ <14>1” prepended with every events as below;

<14>1 2024-01-18T13:45:06.621+0000 756565656565701b-cd27-475e-bab4-3e0e0893d273

<14>1 2024-01-18T13:39:47.014+0000 565gt5t54t-cd27-475e-bab4-565656565gh

roopeshetty_1-1705586279086.jpeg

We are trying to remove this prefix texts “<14>1” using SEDCMD  on props.conf as below;

[source::tcp:7514]

SEDCMD-strip-tcp-priority=s/^<\d+>//

This is doing almost very close help by removing “<14>” but still “1” is coming up in events. Can some one please help us how to remove this prefix “ <14>1” on every events using SEDCMD ?

Regards.

[ITWhisperer · Accepted solution]

SEDCMD-strip-tcp-priority=s/^<\d+>\d//

[roopeshetty]

Hi ITWhisperer,

Thanks, its almost done, but i see a space (gap) before the timestamp, how can we delete this space?

roopeshetty_1-1705587291332.png

[ITWhisperer]

SEDCMD-strip-tcp-priority=s/^<\d+>\d\s//

[PickleRick]

If you need to tweak your regexes, that's a great interactive tool to test them.

https://regex101.com/