Keep Last

Text Processing Data Analysis

Synopsis

Keeps the last N characters of a string, or of each string in an array.

Schema

- keep_last:
    field: <ident>
    count: <string>
    target_field: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Source field containing string or array to process
count	Y	-	Number of characters to keep from the end. Quote the value — it is read as a string
target_field	N	Same as field	Target field to store result
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if operation fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details

Extracts the last N characters of a string. Given an array, it applies that truncation to every element — it does not select the last N elements. Useful for suffixes, file extensions and the tail of a value.

Truncation is at character boundaries, so multi-byte characters are never split. Elements of an array are converted to strings before truncation.

note

When processing strings, the processor counts Unicode characters correctly from the end, not bytes. This ensures proper handling of international characters and emojis.

If the specified count is greater than the length of the string or array, the processor returns the entire original value without modification.

warning

Non-string and non-array values will cause the processor to fail unless ignore_failure is set to true. The processor cannot determine what "last N" means for other data types.

Examples

String Suffix Extraction

Keeping last 5 characters of a filename...	{ "filename": "document_2024_report.xlsx" } - keep_last: field: filename count: "5" target_field: extension
extracts file extension:	{ "filename": "document_2024_report.xlsx", "extension": ".xlsx" }

Arrays Are Truncated Element-wise

Getting last 2 elements from event array...	{ "recent_events": [ "login", "view_page", "edit_profile", "upload_file", "logout" ] } - keep_last: field: recent_events count: "2" target_field: latest_events
truncates EVERY element to its last 2 characters — it does not take the last 2 elements:	{ "recent_events": [...], "latest_events": ["in", "ge", "le", "le", "ut"] }

Log ID Extraction

Extracting last part of a long identifier...	{ "transaction_id": "TXN-2024-01-15-14-30-45-ABC123" } - keep_last: field: transaction_id count: "6" target_field: short_id
creates short identifier:	{ "transaction_id": "TXN-2024-01-15-14-30-45-ABC123", "short_id": "ABC123" }

Path Tail Extraction

Getting the last part of a file path...	{ "file_path": "/var/log/application/server.log" } - keep_last: field: file_path count: "10" target_field: filename_part
extracts filename portion:	{ "file_path": "/var/log/application/server.log", "filename_part": "server.log" }

In-Place Trimming

Keeping only the last part of a URL...	{ "request_url": "https://api.example.com/v1/users/profile/settings" } - keep_last: field: request_url count: "8"
overwrites with last 8 characters:	{ "request_url": "settings" }