# How Do I Truncate Field

**URL:** <https://community.graylog.org/t/how-do-i-truncate-field/18822>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [February 16, 2021, 5:26pm UTC](https://community.graylog.org/t/how-do-i-truncate-field/18822 "2021-02-16T17:26:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![poisedforflight](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/poisedforflight/32/6729_2.png) [@poisedforflight](https://community.graylog.org/u/poisedforflight)\
**Post date:** [February 16, 2021, 5:26pm UTC](https://community.graylog.org/t/how-do-i-truncate-field/18822/1 "2021-02-16T17:26:45Z")

</div>

I have a field that I need to remove the “::ffff:” from to just give me the IPv4.

Is there a way to add this as a pipeline rule?

event\_data\_IpAddress ::ffff:192.168.69.141

I found this example but I’m not sure how to build this into a pipeline:

// Extract the substring starting at offset 0 and stopping at offset 2  
// Below example will return “ab”  
substring(“abc”, 0, 2)

---

<div class="post-metadata">

**Author:** ![poisedforflight](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/poisedforflight/32/6729_2.png) [@poisedforflight](https://community.graylog.org/u/poisedforflight)\
**Post date:** [February 16, 2021, 6:17pm UTC](https://community.graylog.org/t/how-do-i-truncate-field/18822/2 "2021-02-16T18:17:24Z")

</div>

Hey, I actually figured it out on my own. For anyone else looking to do something similar:

rule “Windows: Event 4678 Cleanup”

when  
has\_field(“event\_data\_Status”) AND contains(to\_string($message.event\_id), “4768”)  
then  
//Change Logon Code  
let update\_source = lookup\_value(“winlogon\_status\_lookup”, $message.event\_data\_Status);  
set\_field(“event\_data\_Status”, update\_source);  
//Cleanup IP Address  
let ip\_address = to\_string($message.event\_data\_IpAddress);  
set\_field(“event\_data\_IpAddress”,substring(ip\_address,7));

end

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 2, 2021, 6:17pm UTC](https://community.graylog.org/t/how-do-i-truncate-field/18822/3 "2021-03-02T18:17:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.