How to remove numbers from events at search time?

[rajgowd1]

Hi,
i have endpoints which are extracted from the log message and some end points are with numbers at the end.
can we replace those last digits with *

here is the extracted field and values

uri = private/credentials/products/CCSID/1001111335764
uri=private/credentials/products/CCSID/1001111336914

can we display like below

uri = private/credentials/products/CCSID/*
uri=private/credentials/products/CCSID/*

[skoelpin]

Try this

... | rex mode=sed "s/\d|\}//g"

[skoelpin]

Why not try this? This does exactly what your looking for

[nabeel652]

Yes, If you are sure that there will always be a number at the end:

... your search | rex field=uri "(?<uri>.*\/)\d+$" | ... 

or if you are not sure about the last part after "/":

... your search | rex field=uri "(?<uri>.*\/).*$" | ...

[rajgowd1]

thank you.
few of the endpoints are having number at the end.so would need to remove number from few of the end points.

[nabeel652]

So if the url ends with digits you want to ignore them but if it ends with Alpha-numeric values you want to leave them as is? Also, is CCSID something that repeats in every url at the same place? If you could send few possible variations of url string it would be easier. Cheers

[rajgowd1]

YES,if the endpoint ends with digit then i want to ignore digit or replace digit with *.

if there any alpha-numeric then i want to leave as is.

CCSID repeats in url at the same place.

[nabeel652]

Try

| rex field=uri "(?<uri>.*[^\d])" 

will extract a uri that doesn't end with digits or ignore the digits if it ends with digits.