Clean and split email address into two new fields

Elastic Stack Logstash
#1

Hello

I have a field from a csv file called email, this field contains a string like this: mailtio:user@domain.tld
I'm trying to remove "mailto:" as first step, then, copying field to a temp. one split the result into two new fields "user" and "provider"

An approach to reach this is something like:

		 mutate {copy => { "email" => "email_tmp" }}
		 mutate{
			split => {"email_tmp" => "@"}
				add_field => ["user", "%{[email_tmp][0]}"]
				add_field => ["provider","%{[email_tmp[1]}"]
			}

But its not working and I have no clue why (yes, I'm using verbose to see the logs, no luck).
What m ' doing wrong?
Thanks in advance.

#2

The second field reference is invalid (it is missing a bracket). Try

mutate { copy => { "email" => "[@metadata][email_tmp]" } }
mutate { gsub => [ "[@metadata][email_tmp]", "^mailto:", "" ] }
mutate {
    split => { "[@metadata][email_tmp]" => "@" }
    add_field => {
        "user" => "%{[@metadata][email_tmp][0]}"]
        "provider" => "%{[@metadata][email_tmp][1]}"]
    }
}
#3

I was waiting for you! Thanks, its working!!!! But it needs two claudators

mutate { copy => { "email" => "[@metadata][email_tmp]" } }
mutate { gsub => [ "[@metadata][email_tmp]", "^mailto:", "" ] }
mutate {
    split => { "[@metadata][email_tmp]" => "@" }
    add_field => {
        "user" => "[%{[@metadata][email_tmp][0]}"]
        "provider" => ["%{[@metadata][email_tmp][1]}"]
    }
}

Again, thanks!

#4

Sorry, that should have been

    "user" => "%{[@metadata][email_tmp][0]}"
    "provider" => "%{[@metadata][email_tmp][1]}"

You do not need the brackets around the string

#5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.