title: How to remove part of the string before specific word using grok or gsub in logstash?
body: <p>I have a string field "origin_message". It is pretty big one (used multiline to get mail content. Example of "origin_message":</p>
  
  <pre><code>Delivered-to: somemail@domain.com A LOT OF OTHER CONTENT Subject: Subject goes here AND THE REST OF THE MESSAGE
  </code></pre>
  
  <p>Desired result:</p>
  
  <pre><code>Subject goes here AND THE REST OF THE MESSAGE
  </code></pre>
  
  <p>Is there a way to trim everything before "Subject:" phrase?</p>
  
  <p>I have tried the following filter with no luck:</p>
  
  <pre><code>filter {
  mutate {
      add_field =&gt; { "original_message" =&gt; "%{message}" }
      convert =&gt; {
          "original_message" =&gt; "string"
      }
  
      gsub =&gt; [
          "original_message", "^(.*)Subject", " "
      ]
  }
  }
  </code></pre>