Help with writing a pipeline to remove numbers from a string

We use filebeat to import a DNS log from our windows servers and there is a field for the DNS request name and it is coming up as this “(3)dns(8)msftncsi(3)com(0)” would there be a way to remove the (number) from the string so that it looks like “”? Currently using Graylog 3.3.1

Thank you for any assistance.

use regex_replace() in a pipeline.

Should be easy to pick out (#) and set it to replace with a period

Something like this could work:

regex_replace("\([0-9]{1}\)", to_string($message.dns_field), ".", true);

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.