Substring [substring]

This processor allows you to overwrite a field's value with a partial substring.

• field
• begin - number of characters from the beginning of the original string that the new string should start from (optional, can be int or str)
• end - number of characters from the beginning of the original string that the new string should end at (optional, can be int or str)

Examples

Log sample

{
    "message": "ALL WORK AND NO PLAY MAKES JOSH A DULL BOY"
}

Sawmill pipeline

{
    "steps": [
        {
            "substring": {
                "config": {
                    "field": "message",
                    "begin": 4,
                    "end": 20
                }
            }
        }
    ]
}

Result

{
  "message": "WORK AND NO PLAY"
}