transform data

[islamyakin]

can i remove some data in path

this is my source expression : (?: +(?<path>(?:[^\"]|\\.)*?)
and output log
"GET /wp-content/plugins/backupbuddy/lib/zipbuddy/ HTTP/1.1"
and i expect to delete HTTP/1.1"

expected
"GET /wp-content/plugins/backupbuddy/lib/zipbuddy/"

give me configuration transform filter
thank u

[kenhys]

If parsed content is stored as record["message"] = "GET /wp-content/plugins/backupbuddy/lib/zipbuddy/ HTTP/1.1",
using @type record_transformer will work for you.

<filter *>
  @type record_transformer
  enable_ruby true
  <record>
    message ${record["message"].sub(/ HTTP\/1.1$/, '')}
  </record>
</filter>

[islamyakin]

ok thank u @kenhys