Trim

Filter Elastic Compatible

Synopsis

Removes leading and trailing whitespace from string values, and optionally a set of other characters as well.

Schema

- trim:
    field: <ident>
    chars: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing string(s) to trim
chars	N	-	Additional characters to strip from both ends, given as a set — each character is removed individually, not as a sequence. Whitespace is trimmed whether or not this is set
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_field	N	field	Field to store the trimmed value(s)

Details

The processor can handle both single string fields and arrays of strings. When processing an array, it trims each element.

warning

If the field contains non-string values, the processor will fail unless ignore_failure is set to true.

note

Only the beginning and end of a string are affected. Whitespace between words is left alone.

Trimming Other Characters

chars is a set of characters, not a string to match: chars: "'\"" strips single quotes and double quotes, in any combination and any number, from both ends.

Whitespace is always trimmed, with or without chars — the option adds to the default behaviour rather than replacing it.

warning

chars is applied first, then whitespace. A value with whitespace outside the characters you are stripping is therefore not fully cleaned in one pass: 'value' with chars: "'" comes back as 'value', because the quotes were never at the ends when the character trim ran.

Include the whitespace in the set to handle both — chars: " '" — or run a plain trim first.

Examples

Single String

Trimming the username...	{ "myusername": " username " } - trim: field: myusername
removes the leading and trailing spaces:	{ "myusername": "username" }

String Arrays

Trimming an array of email addresses...	{ "myemails": [ " email@example.com ", " admin@example.org " ] } - trim: field: myemails
removes leading and trailing spaces from each:	{ "myemails": [ "email@example.com", "admin@example.org" ] }

Keep Original

Storing the trimmed values in a new field...	{ "original": " value " } - trim: field: original target_field: trimmed
preserves the original:	{ "original": " value ", "trimmed": "value" }

Stripping Quotes

Removing the quoting a parser left behind...	{ "values": ["'value1'", "\"value2\"", "'value3'"] } - trim: field: values chars: "'\""
both quote characters are stripped, element by element:	{ "values": ["value1", "value2", "value3"] }