Grok Extractor - Remove data from field

@shoothub, I’m sorry to keep bothering you but you’re the only person who’s offered to help from the 4 or 5 forums I posted this on.

If anyone else can help, I’d very much appreciate that as well.

I’m working on parsing a message from a syslog input. I have a long string that I need to break up. I need to discard some information from the field and am curious if there is a way to accomplish this. I’m trying to remove what’s highlighted.

I’m fairly certain it’s a ${GREEDYDATA:UNWANTED} but I can’t get it to work with any separators that I have tried.

Try to use %{USERNAME:user} instead.

1 Like

You’re incredible, thank you.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.