# Can telegraf processor Regex replace by empty string?

**URL:** <https://community.influxdata.com/t/can-telegraf-processor-regex-replace-by-empty-string/8881>\
**Category:** Systems\
**Tags:** telegraf, regex\
**Created:** [March 5, 2019, 10:17am UTC](https://community.influxdata.com/t/can-telegraf-processor-regex-replace-by-empty-string/8881 "2019-03-05T10:17:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![keepgoing147](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@keepgoing147](https://community.influxdata.com/u/keepgoing147)\
**Post date:** [March 5, 2019, 10:17am UTC](https://community.influxdata.com/t/can-telegraf-processor-regex-replace-by-empty-string/8881/1 "2019-03-05T10:17:57Z")

</div>

Hi,

I was wondering if telegraf processor ‘Regex’ can replace regex matched string with blank or not, I try to leave replacement field blank, but seems not working, is there any way to do this?

![Capture](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex023/uploads/influxdata/original/2X/a/a29a0c1261f5c98bd93f675d38f5dc6cef1c4cc0.png)

---

<div class="post-metadata">

**Author:** ![rawkode](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/rawkode/32/5161_2.png) [@rawkode](https://community.influxdata.com/u/rawkode)\
**Post date:** [March 5, 2019, 10:30am UTC](https://community.influxdata.com/t/can-telegraf-processor-regex-replace-by-empty-string/8881/2 "2019-03-05T10:30:59Z")

</div>

Can you provide a sample line from your log that you wish the replacement to happen on?

---

<div class="post-metadata">

**Author:** ![keepgoing147](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@keepgoing147](https://community.influxdata.com/u/keepgoing147)\
**Post date:** [March 6, 2019, 1:41am UTC](https://community.influxdata.com/t/can-telegraf-processor-regex-replace-by-empty-string/8881/3 "2019-03-06T01:41:08Z")

</div>

Sorry for lack of information, I found a workaround solution.

The sample log is nginx access log, and I parse it by using input.tail:

 ![Capture2](https://us1.discourse-cdn.com/flex023/uploads/influxdata/original/2X/9/93f0e56708dd398d7b56f0532fb113add7fede5a.png)

But fields like ‘user’ and ‘referer’ might be ‘-’, I want to replace with empty string, so that the data collect by telegraf agent will be standardize, and it will help me easier to use this data for further parsing.

Unfortunately processor.regex replacement config cannot be set empty string (replacement = “”), and I need regex to full match ‘-’ (^-$), when processor.strings only support substring replacement, that means when referer value is ‘/test.action?xx=asd-fgh’, it will be ‘/test.action?xx=asdfgh’, that’s not I want.

The workaround I use is this:  
[[processors.strings]]  
namepass = [“test.log.\*”]  
[[processors.regex]]  
[[processors.regex.fields]]  
key = “referer”  
pattern = “^-" replacement = "" [[processors.strings.trim\_prefix]] field = "referer" prefix = "-" [[processors.regex.fields]] key = "user" pattern = "^-”  
replacement = “”  
[[processors.strings.trim\_prefix]]  
field = “user”  
prefix = “-”

1. identify string only contian 1 ‘-’ through regex.
2. because regex replacement not support empty string “”, use strings processor instead.
3. use processor strings trim to eliminate ‘-’.

---

<div class="post-metadata">

**Author:** ![keepgoing147](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@keepgoing147](https://community.influxdata.com/u/keepgoing147)\
**Post date:** [March 6, 2019, 10:03am UTC](https://community.influxdata.com/t/can-telegraf-processor-regex-replace-by-empty-string/8881/4 "2019-03-06T10:03:48Z")

</div>

My mistake, I discover that nest input plugins do not have condition handling, so I fix to this:

 ![Capture](https://us1.discourse-cdn.com/flex023/uploads/influxdata/original/2X/8/89d0b2581c27626c4e270cbaa1c9bc56de1c2c57.png)