# Graylog Remove Field That Matches Regular Expression

**URL:** <https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507>\
**Category:** Graylog Central (peer support)\
**Created:** [August 7, 2019, 5:55pm UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507 "2019-08-07T17:55:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmentor](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rmentor](https://community.graylog.org/u/rmentor)\
**Post date:** [August 7, 2019, 5:55pm UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/1 "2019-08-07T17:55:26Z")

</div>

I’m trying to configure a rule that will drop remove any field that matches “Form\_\_member\_name\_” with 7 digits after (i.e . Form\_\_member\_name\_1234567) I have this much but I’m not sure how to go about attaching a regex to my rule:

```
rule "function removeFields"
when
    has_field("Form__member_name_")
then
    remove_field("Form__member_name_");
end

```

Is it possible to set a field to look for with a regex in your rule?

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [August 11, 2019, 10:15am UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/2 "2019-08-11T10:15:03Z")

</div>

yes you can.  
eg.

```auto
regex("^.*(cde\\.)(:(\\d+))?.*$", "abcde.fg").matches == true 

```

But maybe it’s enought

```auto
contains(to_string($message.log_type),"IIS",true)

```

---

<div class="post-metadata">

**Author:** ![rmentor](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rmentor](https://community.graylog.org/u/rmentor)\
**Post date:** [August 12, 2019, 5:31pm UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/3 "2019-08-12T17:31:50Z")

</div>

This regex works on regex query testers but not in Graylog. Any assistance?

```
^(?i)([a-z]{4}).([a-z]{7}).([a-z]{6}).(\d{3})$
```

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [August 13, 2019, 9:13am UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/4 "2019-08-13T09:13:01Z")

</div>

check your regexp and mine.  
there is the reason.

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [August 13, 2019, 9:15am UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/5 "2019-08-13T09:15:55Z")

</div>

From reading this, it looks like what @rmentor is trying to do is perform a regex match against the field name(s,) not the values of the fields.

AFAIK, this is not possible. You can perform the regex on the values of the fields but, not the names of fields.

---

<div class="post-metadata">

**Author:** ![rmentor](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@rmentor](https://community.graylog.org/u/rmentor)\
**Post date:** [August 13, 2019, 6:10pm UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/6 "2019-08-13T18:10:00Z")

</div>

@Ponet that’s exactly what I was trying to do. Thanks for the information. I’ll try to come at this from another angle.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 27, 2019, 6:10pm UTC](https://community.graylog.org/t/graylog-remove-field-that-matches-regular-expression/11507/7 "2019-08-27T18:10:01Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.