We have updated our Terms of Service, Code of Conduct, and Addendum.

How can I drop part of a syslog header?

saurabh.gupta Posts: 27
edited September 2023 in General Discussions

my raw event looks like this α    _raw: `*Mar 31 09:21:11 10.x.x.x* time=1680239950|hostname=D-xxxx|product=test`

I want to drop only the syslog header part (shown in Bold above) I am trying to use parse with extract and serialize. I also tried with parse (reserialize) but the full event length is going high, I need to drop header and reduce the size of full event as well... how can I do this?

Best Answer