# Filter username or email address within space delimited string

**URL:** <https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479>\
**Category:** Logstash\
**Created:** [February 6, 2021, 1:20am UTC](https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479 "2021-02-06T01:20:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![earlsanchez](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\
**Post date:** [February 6, 2021, 1:20am UTC](https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479/1 "2021-02-06T01:20:07Z")

</div>

Hello,  
I'm trying to create a Logstash filter using Grok for the following log event:

```auto
2021-01-15 15:36:08.081 ERROR t:44 com.ixiasoft.physicalModel.TextmlSession.loginWithServerConnection:321 Unable to authenticate user jane.smith@domain.com com.ixia.textmlserver.corbaimpl.exceptions.ErrorImp: HRESULT <0x0> : Login failed.

```

Using the Grok Debugger I've come up with the following pattern match thus far:

```auto
%{TIMESTAMP_ISO8601:date} %{LOGLEVEL:loglevel}\s*\S+\s*%{NOTSPACE:logger}\s*%{GREEDYDATA:exception} %{USER:user} %{GREEDYDATA:exception2}

```

I know the 1st %{GREEDYDATA:exception} is not right, but I can't figure how to get past the "Unable to authenticate user" string so that I can capture the "user" field. I assume it needs to be some Regex pattern but can some one help me with this?

My ultimate goal is to be able to set an alarm in Kibana so I will need to be able to search for ("loglevel:ERROR" and "Unable to authenticate user"), and be able to display the "user" field. Ultimately, I think these are the fields I need to parse from the above log event:

```auto
"date" => "2021-01-15 15:36:08.081", 
"loglevel" => "ERROR", 
"user" => "jsmith", "jane.smith", "jane.smith@domain.com"
("user" could be any of the 3 patterns.)

```

Could some one please help with the grok pattern?

TIA!

---

<div class="post-metadata">

**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\
**Post date:** [February 6, 2021, 6:04am UTC](https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479/2 "2021-02-06T06:04:32Z")

</div>

I tried to change your grok a little and see if this is what you are trying to achieve?

Grok Pattern:

```auto
%{TIMESTAMP_ISO8601:date} %{LOGLEVEL:loglevel}\s+\S+\s+%{NOTSPACE:logger}\s+(?<logerror>Unable to authenticate user)\s+%{NOTSPACE:email_address}\s+%{GREEDYDATA:exception2}

```

Output

```
{
  "date": [
    "2021-01-15 15:36:08.081"
  ],
  "YEAR": [
    "2021"
  ],
  "MONTHNUM": [
    "01"
  ],
  "MONTHDAY": [
    "15"
  ],
  "HOUR": [
    "15",
    null
  ],
  "MINUTE": [
    "36",
    null
  ],
  "SECOND": [
    "08.081"
  ],
  "ISO8601_TIMEZONE": [
    null
  ],
  "loglevel": [
    "ERROR"
  ],
  "logger": [
    "com.ixiasoft.physicalModel.TextmlSession.loginWithServerConnection:321"
  ],
  "logerror": [
    "Unable to authenticate user"
  ],
  "email_address": [
    "jane.smith@domain.com"
  ],
  "exception2": [
    "com.ixia.textmlserver.corbaimpl.exceptions.ErrorImp: HRESULT <0x0> : Login failed."
  ]
}

```

Hope this could help you!

---

<div class="post-metadata">

**Author:** ![earlsanchez](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\
**Post date:** [February 8, 2021, 7:11pm UTC](https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479/3 "2021-02-08T19:11:52Z")

</div>

Thank you @kavierkoo, your solution works. I think I was expecting it to be more complicated than it actually is.

---

<div class="post-metadata">

**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\
**Post date:** [February 9, 2021, 8:13am UTC](https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479/4 "2021-02-09T08:13:20Z")

</div>

Glad that helped you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2021, 8:13am UTC](https://discuss.elastic.co/t/filter-username-or-email-address-within-space-delimited-string/263479/5 "2021-03-09T08:13:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.