How to write rex to remove?

[joe06031990]

Hi,

I have the bellow event:

{"log":"2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359               1 connection.go:153]

connecting to UNIX:///csi/csi.sock"

I need to remove 2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 and have tried rex but unable to do so, just wondered if someone could help me?

Thanks,

Joe

[ITWhisperer]

rex works with pattern matching - is it just this exact string you want to remove or are there similar strings? If so, what pattern do the strings follow? This is key to determining what regular expression to use.

[richgalloway]

By "remove" do you mean you want to get rid of that text or extract it into fields?

What regular expressions (rex commands) have you tried so far?

[joe06031990]

Yeah I want to completely remove 2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359.

[ITWhisperer · Accepted solution]

| replace "2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359" WITH "" IN _raw