Ok, in the question I am trying to remove the top level Json and trailing ]} so what remains is a bunch of Json objects {...} separated by commas. The regex strings matched and worked but the nullQueue options will remove the whole event where it finds a match to the regex. So I was unintentionally removing the whole event. What I needed to use was the SEDCMD in props.conf like so SEDCMD-removeNestingStart = s/(\{\"success\":true,\"message\":\"\",\"result\":\[)// SEDCMD-removeNestingEnd =s/(\]\})// This succesfully removes only the matched string. Hopefully this'll help any one elses mis-understanding ... View more