Delete specific data from message field

[haxioor]

Hello, I need to delete specific data from message.
My message box starts like this:
<188>date=2023-05-25 time=10:05:24
I need to delete from message field “<188>”.
How I can do this?

[faen]

I would use a grok pattern in a pipeline rule to strip out 188 and set fields for date and time, or combine them if needed. Others may prefer a regex pattern, but I am more handy with Grok.

[haxioor]

Can You show Your grok pattern?

[faen]

I don’t have one for this specific log, but here’s one that should work:

<%{INT:number}>date=%{YEAR:Year}-%{MONTHNUM:Month}-%{MONTHDAY:Day} time=%{TIME:time}

If you want the date as a whole timestamp, you can play around with the GROK formats, or re-assemble it later.

You may also be able to use key/value functions if the logs are consistent in this format. Good luck!