# Extract a substring from field

**URL:** <https://discuss.elastic.co/t/extract-a-substring-from-field/173336>\
**Category:** Kibana\
**Created:** [March 21, 2019, 3:04pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336 "2019-03-21T15:04:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francesco\_Denardi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/francesco_denardi/32/42496_2.png) [@Francesco\_Denardi](https://discuss.elastic.co/u/Francesco_Denardi)\
**Post date:** [March 21, 2019, 3:04pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336/1 "2019-03-21T15:04:33Z")

</div>

Hi,

I would extract a substring from field for example

I have this field

**@message**  
type=USER\_AUTH msg=audit(155558731.704:1977444): pid=126 uid=0 auid=42949672915 ses=42945 msg='op=PAM:authentication grantors=pam\_unix acct="rodrigo.adsa" exe="/usr/sbin/sshd" hostname=baseserver addr=19.13.22.10 terminal=ssh res=success

I would to create SUB field for exemple

@type USER\_AUTH  
@acct "rodrigo.adsa"  
@hostname baseserver

I know that it's possible made this from "script field" and also with GROK INGEST  
Which is the best solution  
How I can do this?

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [March 22, 2019, 12:02pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336/2 "2019-03-22T12:02:18Z")

</div>

The best solution is to do this at ingest as it will be less resource intensive. I recommend asking in the Logstash forums as they have more expertise on this.

---

<div class="post-metadata">

**Author:** ![Francesco\_Denardi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/francesco_denardi/32/42496_2.png) [@Francesco\_Denardi](https://discuss.elastic.co/u/Francesco_Denardi)\
**Post date:** [March 22, 2019, 1:26pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336/3 "2019-03-22T13:26:31Z")

</div>

Yes I know but i've used a Elasticsearch service on AWS, so I put data into elastic cluster with lamba function, so i prefer for now to use script field. is it possible?

---

<div class="post-metadata">

**Author:** ![sebastien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastien/32/36119_2.png) [@sebastien](https://discuss.elastic.co/u/sebastien)\
**Post date:** [March 22, 2019, 1:45pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336/4 "2019-03-22T13:45:08Z")

</div>

Yes, you probably want to go with ingest pipeline then  
[https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2019, 1:45pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336/5 "2019-04-19T13:45:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.