HI,
Is there a way to parse a field further after its already been parsed by grok? So after I parse out DN from the main message, I now want to parse DN further as it contains a username. So I want to parse out test.Test as a username after it already been parsed as DN.
12-MAR-21 00:43:38|158.98.214.94|15|CN=Test.Test,OU=alpha Users,OU=alpha,OU=Business Units,DC=alphadev,DC=dev,DC=abc,DC=ca|foJ16BD1/B42LI5Cfke/D4oDcUA=|TEST"
filter {
grok {
match => { "message" => [ "%{GREEDYDATA:timestamp}\|%{IPV4:src_ip}\|%{WORD:event_id}\|%{GREEDYDATA:DN}\|%{NOTSPACE:session}\|%{WORD:application}" ] }
remove_field => ["message"]
grok
}
}