how to remove characters from strings

[hqw]

Hi all,

I have some value under geologic_city fields as below, but it has some problems. For example, actually Anshan and Anshan Shi is the same city, and i have multiple cities have this issue. I want to remove all "Shi" if the string has. Can anyone help me on this?

Thanks

[javiergn · Accepted solution]

Try this:

| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))

Careful as it is case sensitive

EDIT. You can have a more granular control (including case insensitive mode) by using rex:

| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"

[hqw]

Thanks a lot javiergn, it works!