Keep Last

Text Processing Data Analysis

Synopsis

Keeps last N characters of strings or N elements of arrays.

Schema

- keep_last:
    field: <ident>
    count: <integer>
    target_field: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Source field containing string or array to process
count	Y	-	Number of characters/elements to keep from the end
target_field	N	Same as field	Target field to store result
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if operation fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

Extracts the last N characters from string values or the last N elements from array values. This processor is useful for extracting suffixes, file extensions, recent entries, or the tail end of data for analysis.

The processor handles both string and array data types automatically, applying the appropriate logic based on the input type. For strings, it counts Unicode characters properly, and for arrays, it preserves the original data types of the elements.

note

When processing strings, the processor counts Unicode characters correctly from the end, not bytes. This ensures proper handling of international characters and emojis.

If the specified count is greater than the length of the string or array, the processor returns the entire original value without modification.

warning

Non-string and non-array values will cause the processor to fail unless ignore_failure is set to true. The processor cannot determine what "last N" means for other data types.

Examples

String Suffix Extraction

Keeping last 5 characters of a filename...	{ "filename": "document_2024_report.xlsx" } - keep_last: field: filename count: 5 target_field: extension
extracts file extension:	{ "filename": "document_2024_report.xlsx", "extension": ".xlsx" }

Recent Array Elements

Getting last 2 elements from event array...	{ "recent_events": [ "login", "view_page", "edit_profile", "upload_file", "logout" ] } - keep_last: field: recent_events count: 2 target_field: latest_events
keeps only last 2 elements:	{ "recent_events": [...], "latest_events": [ "upload_file", "logout" ] }

Log ID Extraction

Extracting last part of a long identifier...	{ "transaction_id": "TXN-2024-01-15-14-30-45-ABC123" } - keep_last: field: transaction_id count: 6 target_field: short_id
creates short identifier:	{ "transaction_id": "TXN-2024-01-15-14-30-45-ABC123", "short_id": "ABC123" }

Path Tail Extraction

Getting the last part of a file path...	{ "file_path": "/var/log/application/server.log" } - keep_last: field: file_path count: 10 target_field: filename_part
extracts filename portion:	{ "file_path": "/var/log/application/server.log", "filename_part": "server.log" }

In-Place Trimming

Keeping only the last part of a URL...	{ "request_url": "https://api.example.com/v1/users/profile/settings" } - keep_last: field: request_url count: 8
overwrites with last 8 characters:	{ "request_url": "settings" }