# Replace or Trim from message field in pipeline rule **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [September 12, 2019, 8:56pm UTC](https://community.graylog.org/t/replace-or-trim-from-message-field-in-pipeline-rule/11952 "2019-09-12T20:56:55Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![rfinney](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rfinney/32/961_2.png) [@rfinney](https://community.graylog.org/u/rfinney)\ **Post date:** [September 12, 2019, 8:56pm UTC](https://community.graylog.org/t/replace-or-trim-from-message-field-in-pipeline-rule/11952/1 "2019-09-12T20:56:55Z")
Hi, I’m sending logs from Fortinet FortiAnalyzer to Graylog in CEF formatting. I’m having issues with forwarded logs from a certain type of device. The first issue is that the field values have " .ad" added to the end of them. The second issue is the timestamp is coming in as UTC but being seen as EDT/EST so logs are ahead 4 hours. I setup a raw TCP input to send the CEF TCP messages to, they look like this: Sep 12 17:20:15 ems CEF:0|Fortinet|FortiClient-EMS|1.2|0| traffic|5|start=Sep 12 2019 17:20:15 ad.logver=N/A cat=traffic deviceSeverity=notice externalID=N/A dhost=N/A [ad.pcdomain=subdomain.company.com](http://ad.pcdomain=subdomain.company.com) ad.uid=N/A deviceExternalId=FCT8104243435915 ad.fgtserial=N/A ad.emsserial=FCTEMS0000000824 ad.regip=N/A shost=chrome.exe ad.srcproduct=Chrome src=10.10.100.101 spt=N/A ad.direction=outbound dst=N/A [ad.remotename=yahoo.com](http://ad.remotename=yahoo.com) dpt=443 [duser=remployee@subdomain.company.com](mailto:duser=remployee@subdomain.company.com) proto=6 in=N/A out=N/A ad.utmaction=userbrowsed ad.utmevent=webfilter ad.threat=Search ad.vd=root ad.fctver=1.0.1.0020 ad.os=cros ad.usingpolicy=RR Chromebook Student app=https request=/ ad.userinitiated=1 ad.browsetime=0.12 When sending to the CEF input it’s giving me: start Sep 12 2019 17:20:15 ad. timestamp 2019-09-12 17:20:15.000 -04:00 Can someone show me an example of how to remove " ad." ? Having read @jan blog [https://jalogisch.de/2018/working-with-cisco-asa-nexus-on-graylog/](https://jalogisch.de/2018/working-with-cisco-asa-nexus-on-graylog/) I think I can get the timezone straightened out with this once I have the " ad." removed. rule “type fortinet-faz-utc-ems-chromebook” // we want to convert utc to edt timestamp when has\_field(“os”) && to\_string($message.os) == “cros ad.” && grok(pattern: “%{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}”, value:to\_string($message.start)).matches == true then let time = parse\_date(value:to\_string($message.start), pattern:“yyyy MMM dd HH:mm:ss.SSS”, timezone:“UTC”); set\_field(“timestamp”,time); end ---
**Author:** ![rfinney](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rfinney/32/961_2.png) [@rfinney](https://community.graylog.org/u/rfinney)\ **Post date:** [September 12, 2019, 11:45pm UTC](https://community.graylog.org/t/replace-or-trim-from-message-field-in-pipeline-rule/11952/2 "2019-09-12T23:45:43Z")
I’m thinking substring or trim\_value\_chars might be able to remove the " ad." ---
**Author:** ![rfinney](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rfinney/32/961_2.png) [@rfinney](https://community.graylog.org/u/rfinney)\ **Post date:** [September 13, 2019, 1:31pm UTC](https://community.graylog.org/t/replace-or-trim-from-message-field-in-pipeline-rule/11952/3 "2019-09-13T13:31:57Z")
Thanks to @jan great post at [https://jalogisch.de/2018/working-with-cisco-asa-nexus-on-graylog/](https://jalogisch.de/2018/working-with-cisco-asa-nexus-on-graylog/) and [https://anotheritblog.net/tag/graylog/](https://anotheritblog.net/tag/graylog/) I’ve got this working. What I’m currently working with… - Remove certain number of characters from the end of a string - Set timestamp without correct timezone to UTC so it displays correctly in local est/edt ## Pipeline stage 0 rule “type fortinet-faz-utc-ems-chromebook-os” // we want to remove " .ad" from the os field when has\_field(“os”) && to\_string($message.os) == “cros ad.” then let var\_os1 = to\_string($message.os); remove\_field(“os”); set\_field(“os”, substring(var\_os1, 0, -4)); end rule “type fortinet-faz-utc-ems-chromebook-start” // we want to remove " .ad" from the start field when has\_field(“start”) && grok(pattern: “%{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} ad.”, value:to\_string($message.start)).matches == true then let var\_start1 = to\_string($message.start); remove\_field(“start”); set\_field(“start”, substring(var\_start1, 0, -4)); end ## Pipeline Stage 1 rule “type fortinet-faz-utc-ems-chromebook-timestamp-2n” // we want to convert timestamp without timezone into utc two number day when has\_field(“start”) && grok(pattern: “%{MONTH} %{MONTHDAY} %{YEAR} %{TIME}”, value:to\_string($message.start)).matches == true then let time = parse\_date(value:to\_string($message.start), pattern:“MMM dd yyyy HH:mm:ss”, timezone:“UTC”); set\_field(“timestamp”,time); end rule “type fortinet-faz-utc-ems-chromebook-timestamp-1n” // we want to convert timestamp without timezone into utc one number day when has\_field(“start”) && grok(pattern: “%{MONTH} %{MONTHDAY} %{YEAR} %{TIME}”, value:to\_string($message.start)).matches == true then let time = parse\_date(value:to\_string($message.start), pattern:“MMM d yyyy HH:mm:ss”, timezone:“UTC”); set\_field(“timestamp”,time); end ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [September 27, 2019, 1:32pm UTC](https://community.graylog.org/t/replace-or-trim-from-message-field-in-pipeline-rule/11952/4 "2019-09-27T13:32:13Z")
Closed on September 27, 2019, 1:32pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.