# Create a new field using Regular Expressions

**URL:** <https://discuss.elastic.co/t/create-a-new-field-using-regular-expressions/139397>\
**Category:** Logstash\
**Created:** [July 10, 2018, 4:10pm UTC](https://discuss.elastic.co/t/create-a-new-field-using-regular-expressions/139397 "2018-07-10T16:10:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [July 10, 2018, 4:10pm UTC](https://discuss.elastic.co/t/create-a-new-field-using-regular-expressions/139397/1 "2018-07-10T16:10:55Z")

</div>

Hi,

I'm trying to extract part of a field using RegEx and create a new field with the extracted text.  
i.e string = alert message|User: johnc |Host: test |Event type: test  
capture = johnc

RegEx example : User: ([^|{1}]+)\s Result: johnc

I know the regex I need, but not which method I should be using.  
Ultimately I want to add a new field with **johnc**  
I've tried gsub and various mutate methods, but no luck.

This method just removes the part I need:

mutate {  
gsub =\> ["user2", "User: ([^|{1}]+)\s", "" ]

Any help would be much appreciated.

**extract from conf file:**  
input {  
jdbc {  
jdbc\_connection\_string =\> "jdbc:postgresql://xxx/xxx?user=xxx"  
jdbc\_user =\> "xxx"  
jdbc\_driver\_library =\> "/usr/local/lib/pgsqljdbc/postgresql.jar"  
jdbc\_driver\_class =\> "org.postgresql.Driver"  
statement =\> "  
SELECT  
Alerts.alertid AS alertid,  
Alerts.timereceived AS timereceived,  
Alerts.message AS message,  
Alerts.eventtime AS eventtime  
FROM  
Alerts  
WHERE Alerts.eventtime \> '2017-01-07'  
AND Alerts.alertid \> :sql\_last\_value  
ORDER BY alertid;  
"  
type =\> "main-alerts"  
last\_run\_metadata\_path =\> "/etc/logstash/last\_run/alerts"  
schedule =\> "\*/1 \* \* \* \*"  
tracking\_column =\> "alertid"  
tracking\_column\_type =\> "numeric"  
use\_column\_value =\> true  
}  
}  
filter {  
if [type] == "main-alerts" {  
mutate {  
convert =\> { "eventtime" =\> "string" }  
}  
date {  
match =\> ["eventtime", "ISO8601"]  
remove\_field =\> ["eventtime"]  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 10, 2018, 4:19pm UTC](https://discuss.elastic.co/t/create-a-new-field-using-regular-expressions/139397/2 "2018-07-10T16:19:02Z")

</div>

```
grok { match => { "message" => "User: (?<user>[^|{1}]+)\s" } }

```

will add a field called user.

---

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [July 10, 2018, 4:37pm UTC](https://discuss.elastic.co/t/create-a-new-field-using-regular-expressions/139397/3 "2018-07-10T16:37:26Z")

</div>

Hi,

This worked:grinning:, many thanks for the quick response. I had been looking for the answer to this for some time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2018, 4:50pm UTC](https://discuss.elastic.co/t/create-a-new-field-using-regular-expressions/139397/4 "2018-08-07T16:50:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.