I need to cut all those things before "sometest, readtest,writetest" on below.

2019-12-09 10:04:34 +0000 Test (err): sometest: some : text server:::test
2019-12-09 10:04:34 +0000 Test (notice): readtest: some
2019-12-09 10:04:34 +0000 Test (info): writetest: some ::: text

expected output :

sometest: some : text server:::test
sometest: some
sometest: some ::: text
  • Your expected output is not right? It just has "sometest" in every line. Also, maybe point out that you want to skip the colons in timestamp to make question more clear.
    – gaoithe
    Dec 9 '19 at 14:20

With sed:

sed 's/[^:]*:[^:]*:[^:]*: //' file

Or with extended regular expressions (ERE):

sed -E 's/([^:]*:){3} //' file


  • any non-: characters followed by : (three times)
  • followed by a space character

with an empty string.


sometest: some : text server:::test
readtest: some
writetest: some ::: text

You can try this with sed, if we are certain of the parenthesis occurrence:

sed 's/^.*): //' file


sometest: some : text server:::test
readtest: some
writetest: some ::: text

Or with cut:

cut -d':' -f4- file | sed 's/^ //'
  • you could also delete fields with sed itself... sed -E 's/^([^:]*:){3} //'
    – Sundeep
    Dec 9 '19 at 14:22
  • Actually It works fine static patterns but I need to get random characters and second thing cut will be removed after 5th colon to entire line only printed in between line. Dec 9 '19 at 14:25
  • I'm sorry it was not -f5- but -f4-. But I don't understand your comment, what is the problem with cut? thanks. Dec 9 '19 at 14:37
  • @VasanthM.Vasanth I changed my sed command. Dec 9 '19 at 14:46

It is an interesting question as you can choose different ways to do this. Some of which are more or less robust in the face or unexpected input. Do you want to explicitly match on the sometest,readtest,writetest keywords for robustness. Or just match any 3rd colon. Use cut command or sed or awk or perl or . . .

The question could be made more clear by pointing out the colons in the date/time that need to be ignored.

# after 3rd colon (but forgetting to strip the space after it)
sed s/[^:]*:[^:]*:[^:]*://

# this cut command does the same as that sed
cut -d: -f 4-

# A cut command delimiting on space might be better actually 
#  assuming two words always to be stripped "Test (something)" 
# this cut command leaves out the whitespace as expected 
cut -d" " -f6-

# after 3rd colon (strip leading space):
sed "s/[^:]*:[^:]*:[^:]*: *//"

# after 3rd colon (strip leading WHITEspace):
sed "s/[^:]*:[^:]*:[^:]*:\s*//"

# cut all those things explicitly before "sometest,readtest,writetest"
sed -E 's/.*(some|read|write)(test:)/\1\2/'

# exactly the same command works in perl
perl -pe 's/.*(some|read|write)(test:)/\1\2/'

Your expected output looked like it had the incorrect leading keywords.

sometest: some : text server:::test
readtest: some
writetest: some ::: text

Finally in your example and in logfiles generally sometimes you want to strip the timestamp, e.g. cut command to keep the "Test (something)" bit:

# A cut command to just strip the timestamp and leave in the "Test (something)" 
cut -d" " -f4-

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.