Axiom
Overview

trim_start_regex

Usage#

Syntax#

trim_start_regex(regex, text)

Parameters#

Name Type Required Description
regex string Yes The regular expression pattern to remove from the beginning.
text string Yes The source string to trim.

Returns#

Returns the source string with leading regex matches removed.

Use case examples#

Remove protocol and host prefixes from full URLs to extract paths.

Query

['sample-http-logs']
| extend full_url = strcat('https://api.example.com', uri)
| extend path_only = trim_start_regex('https?://[^/]+', full_url)
| summarize request_count = count() by path_only, method
| sort by request_count desc
| limit 10

Run in Playground

Output

path_only method request_count
/api/users GET 2341
/api/orders POST 1987

This query strips protocol and host information from URLs to focus on path-based analysis.

Remove environment and instance prefixes from service names using regex.

Query

['otel-demo-traces']
| extend cleaned_service = trim_start_regex('^(prod|dev|staging)-[0-9]+-', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service span_count
frontend 4532
checkout 3421
cart 2987

This query removes environment names and instance numbers from the beginning of service names, enabling service-level aggregation across all deployments.

Remove timestamp or log level prefixes from security event messages.

Query

['sample-http-logs']
| extend simulated_message = strcat('ERROR: ', uri)
| extend cleaned_message = trim_start_regex('^(ERROR|WARN|INFO): ', simulated_message)
| project _time, simulated_message, cleaned_message, id, status
| limit 10

Run in Playground

Output

_time simulated_message cleaned_message id status
2024-11-06T10:00:00Z ERROR: /admin /admin user123 403

This query removes log level prefixes from security messages, extracting the core message content for analysis.

  • trim_start: Removes leading characters. Use this for simple character-based trimming without regex.
  • trim_regex: Removes both leading and trailing regex matches. Use this for bidirectional pattern trimming.
  • replace_regex: Replaces regex matches. Use this when you need to replace patterns rather than just remove leading ones.
  • trim_end_regex: Removes trailing regex matches. Use this to trim patterns from the end.

Other query languages#

Splunk SPL users

In Splunk SPL, you use rex with mode=sed for pattern-based trimming. APL's trim_start_regex provides a more direct approach.

Splunk example

| rex field=field mode=sed "s/^pattern//g"

APL equivalent

['sample-http-logs']
| extend cleaned = trim_start_regex('pattern', field)
ANSI SQL users

In ANSI SQL, regex-based trimming requires database-specific functions. APL's trim_start_regex provides standardized pattern-based trimming.

SQL example

SELECT REGEXP_REPLACE(field, '^pattern', '') AS cleaned FROM logs;

APL equivalent

['sample-http-logs']
| extend cleaned = trim_start_regex('pattern', field)

Updated

Was this page helpful?