# Remove date from message

**URL:** <https://community.graylog.org/t/remove-date-from-message/25217>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [August 10, 2022, 12:52am UTC](https://community.graylog.org/t/remove-date-from-message/25217 "2022-08-10T00:52:28Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_11](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chris_11/32/12663_2.png) [@Chris\_11](https://community.graylog.org/u/Chris_11)\
**Post date:** [August 10, 2022, 12:52am UTC](https://community.graylog.org/t/remove-date-from-message/25217/1 "2022-08-10T00:52:28Z")

</div>

I have some logs that send timestamps in their messages, which I cannot change.  
Hence I want to create a rule to catch and remove that. I have tried the following - unsuccessful so far (I have tried with “true” instead of the contains rule, too):

```auto
rule "Remvove date"
when
    contains(to_string($message.application_name), "mytimeapp", true)
then
    regex_replace(".*([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}).*", to_string($message.message), "", false);
end

```

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 10, 2022, 1:56am UTC](https://community.graylog.org/t/remove-date-from-message/25217/2 "2022-08-10T01:56:55Z")

</div>

Hello && Welcome @Chris_11

By chance is this a issue? If this is… might want to change category to **Graylog Central,** This is basically for sharing Ideas and templates members created to help other out. 👍

Can you post a example of the message?

---

<div class="post-metadata">

**Author:** ![Chris\_11](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chris_11/32/12663_2.png) [@Chris\_11](https://community.graylog.org/u/Chris_11)\
**Post date:** [August 10, 2022, 3:54am UTC](https://community.graylog.org/t/remove-date-from-message/25217/3 "2022-08-10T03:54:05Z")

</div>

Hi @gsmith and thank you!  
I’m not sure whether this is an issue, or if I’m doing something wrong (newbie here 🙂 ). Here’s an example message that should fit (at least regex- wise):

```auto
2022-08-10 02:39:18 DEBUG base_http.call_openapi:415 [...someothercontenthere...] [200]

```

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 10, 2022, 4:17am UTC](https://community.graylog.org/t/remove-date-from-message/25217/4 "2022-08-10T04:17:50Z")

</div>

> [@Chris\_11](#):
>
> I’m not sure whether this is an issue, or if I’m doing something wrong (newbie here 🙂 ).

Total understand, I need to find out what your trying to do.  
BUT 😃  
Since you have trouble with pipeline I consider this a incident. I moved it to Graylog Central so others can jump in help ya also.  
As for the pipeline, I’m sorry I don’t understand exactly you want.  
What I do understand is that you want to remove data from a field? Is this correct?

If so, this data under the fields called **application\_name**? which is the message you just posted?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 10, 2022, 4:28am UTC](https://community.graylog.org/t/remove-date-from-message/25217/5 "2022-08-10T04:28:28Z")

</div>

Hey,

Did a quick forum search on this, maybe this might help.

- [Replace or Trim from message field in pipeline rule](https://community.graylog.org/t/replace-or-trim-from-message-field-in-pipeline-rule/11952)

---

<div class="post-metadata">

**Author:** ![Chris\_11](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chris_11/32/12663_2.png) [@Chris\_11](https://community.graylog.org/u/Chris_11)\
**Post date:** [August 10, 2022, 5:30am UTC](https://community.graylog.org/t/remove-date-from-message/25217/6 "2022-08-10T05:30:44Z")

</div>

Thanks you - not really - or, not that I’m aware of 🙂  
Ok let’s sum this up: I have a message coming in from a syslog- forwarder. Hence, the “full\_message” (which I can see in the graylog search) is:

```auto
<190>1 2022-08-10T02:40:25.902071+02:00 my_server mytimeapp - - - 2022-08-10 02:40:25 DEBUG base_http.call_openapi:415 [...someothercontenthere...] [200]

```

the “message” is shown as:

```auto
2022-08-10 02:39:18 DEBUG base_http.call_openapi:415 [...someothercontenthere...] [200]

```

and the “application\_name” is

```auto
mytimeapp

```

Now, I’m confronted with a timestamp from syslog (2022-08-10T02:40:25.902071+02:00), and one from the actual application (2022-08-10 02:39:18). I want to remove the timestamp (plus one whitespace) from the application log and leave only the syslog timestamp.  
So my idea was, to filter only messages that I can catch with that specific application name:

```auto
contains(to_string($message.application_name), "mytimeapp", true)

```

and replace the timestamp (regex: ([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}) ) with an empty string (“”):

```auto
regex_replace(".*([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}).*", to_string($message.message), "", false);

```

What am I doing wrong?  
Thank you!

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [August 10, 2022, 3:31pm UTC](https://community.graylog.org/t/remove-date-from-message/25217/7 "2022-08-10T15:31:18Z")

</div>

Here are a few things I noticed:

- you can make the `when` portion more efficient by just checking to see if `application_name` equals `mytimeapp` rather than searching for it.

- You need to assign the results of your `regex_replace()` back onto the field you are interested in with `set_field()`

```auto
rule "Remove date"
when

    to_string($message.application_name) == "mytimeapp"
    
then
    set_field("message", regex_replace(".*([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}).*", to_string($message.message), "", false));
end

```

That should work for you. 😃

---

<div class="post-metadata">

**Author:** ![Chris\_11](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chris_11/32/12663_2.png) [@Chris\_11](https://community.graylog.org/u/Chris_11)\
**Post date:** [August 12, 2022, 2:35am UTC](https://community.graylog.org/t/remove-date-from-message/25217/8 "2022-08-12T02:35:27Z")

</div>

Thanks a lot, that was a very helpful Input!  
I’m almost there, had to make some adjustments:

```auto
rule "Remvove duplicate date"
when
    to_string($message.application_name) == "mytimeapp"
then
    let new_message = regex("^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2} (.*)", to_string($message.message));
    set_field("message", to_string(new_message));
end

```

Now: the “full\_message” looks fine, but the “message” has some sort of encapsulation “{0=…message…}”:

```auto
{0=DEBUG base_http.call_openapi:415 [...someothercontenthere...] [200]}

```

Any ideas how to get rid of that?

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [August 12, 2022, 3:57pm UTC](https://community.graylog.org/t/remove-date-from-message/25217/9 "2022-08-12T15:57:39Z")

</div>

I think you can do it like this:

`set_field("message", new_message["0"]);`

---

<div class="post-metadata">

**Author:** ![Chris\_11](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chris_11/32/12663_2.png) [@Chris\_11](https://community.graylog.org/u/Chris_11)\
**Post date:** [August 15, 2022, 4:56am UTC](https://community.graylog.org/t/remove-date-from-message/25217/10 "2022-08-15T04:56:22Z")

</div>

Awesome, that solved it - thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 29, 2022, 4:56am UTC](https://community.graylog.org/t/remove-date-from-message/25217/11 "2022-08-29T04:56:25Z")

</div>

Closed on August 29, 2022, 4:56am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.