# Grok username in iis log **URL:** \ **Category:** Logstash\ **Created:** [October 3, 2017, 10:33am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543 "2017-10-03T10:33:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\ **Post date:** [October 3, 2017, 10:33am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/1 "2017-10-03T10:33:44Z")
Hi, I have an IIS log, example: "**2017-10-01 08:29:29 10.70.4.52 GET /Shared+Documents/Forms/AllItems.aspx AjaxDelta=1&isStartPlt1=1506846557836 80 0#.w|auto\user\_sppano\_dev 10.70.4.52 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.2;+WOW64;+Trident/6.0;+.NET4.0E;+.NET4.0C;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729) [http://sppano/\_layouts/15/start.aspx#/Shared%20Documents/Forms/AllItems.aspx](http://sppano/_layouts/15/start.aspx#/Shared%20Documents/Forms/AllItems.aspx) 200 0 0 11585**" I tried with **grok** to parse this, I tried to parse the user name %{USER:user} - not getting any thing, the only way I get something is with **%{NOTSPACE:username}** but I get the all string **0#.w|auto\user\_sppano\_dev** I need to get only the user name **user\_sppano\_dev** need help with this issue Thanks, Lior ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 4, 2017, 8:46pm UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/2 "2017-10-04T20:46:01Z")
What does "0#.w|auto\" mean? Is that string different between different events? If it's always the same you could say `0#\.w\|auto\\%{NOTSPACE:user}`. ---
**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\ **Post date:** [October 8, 2017, 5:42am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/3 "2017-10-08T05:42:52Z")
No, "Auto" it is just example for domain name 0#.w|domain name\usename ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 8, 2017, 9:08am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/4 "2017-10-08T09:08:55Z")
Then `0#\.w\|%{WORD}\\%{NOTSPACE:user}` should work fine. ---
**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\ **Post date:** [October 8, 2017, 9:16am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/5 "2017-10-08T09:16:26Z")
Hi, I put it like this in the grok line and it is not working match =\> ["message","%{TIMESTAMP\_ISO8601:log\_timestamp} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{POSINT:port} 0#.w|%{WORD}\%{NOTSPACE:username:string} %{IP:clientIP} %{NOTSPACE:userAgent} %{URI:URL} %{NUMBER:response}"] ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 9, 2017, 7:18pm UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/6 "2017-10-09T19:18:16Z")
Please format the configuration as preformatted text so we can see exactly what it looks like. ---
**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\ **Post date:** [October 10, 2017, 5:00am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/7 "2017-10-10T05:00:30Z")
Hi, this is example of line from IIS log: _2017-10-01 08:29:30 10.70.4.52 GET /Lists/NewsFeed/AllItems.aspx AjaxDelta=1 80 0#.w|c-ad\sp\_dev 10.70.4.52 Mozilla/4.0+(compatible;+MSIE+7.0;_ this is the grok line: grok { match =\> ["message","%{TIMESTAMP\_ISO8601:log\_timestamp} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{POSINT:port} %{NOTSPACE:username} %{IP:clientIP} %{NOTSPACE:userAgent} %{URI:URL} %{NUMBER:response}"]} when I put 0#.w|%{WORD}\%{NOTSPACE:user} and run logstash I don't get "username" filed ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 10, 2017, 5:15am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/8 "2017-10-10T05:15:43Z")
Please format the configuration as preformatted text so we can see exactly what it looks like. Use the `` toolbar button or look up how to use Markdown formatting. > when I put 0#.w|%{WORD}%{NOTSPACE:user} and run logstash I don't get "username" filed I assume you mean you don't get a `user` field since that's what the grok expression creates for you. ---
**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\ **Post date:** [October 10, 2017, 5:17am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/9 "2017-10-10T05:17:47Z")
yes, I don't get the user field ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 7, 2017, 5:18am UTC](https://discuss.elastic.co/t/grok-username-in-iis-log/102543/10 "2017-11-07T05:18:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.