# Gsub syntax to remove all before \\

**URL:** <https://discuss.elastic.co/t/gsub-syntax-to-remove-all-before/103243>\
**Category:** Logstash\
**Created:** [October 9, 2017, 2:58pm UTC](https://discuss.elastic.co/t/gsub-syntax-to-remove-all-before/103243 "2017-10-09T14:58:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [October 9, 2017, 2:58pm UTC](https://discuss.elastic.co/t/gsub-syntax-to-remove-all-before/103243/1 "2017-10-09T14:58:17Z")

</div>

Hi,

I'm trying to write up a gsub to remove everything before a slash. My input will come in the format of something similar to:

LP-45XP\joe.bloggs  
3G49-2AP\john.doe  
random\_PC-domain\_name\random\_firstname.random\_lastname

All I'm looking for is the firstname.lastname from the field.

Currently, after trying all sorts of iterations, I have:

`gsub => ["UserName", "[*\\]", "" ]`

Still doesn't fix my problem.

Could I get a pointer on the structure of the gsub I need and the method behind it?

Thanks.

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [October 9, 2017, 3:03pm UTC](https://discuss.elastic.co/t/gsub-syntax-to-remove-all-before/103243/2 "2017-10-09T15:03:43Z")

</div>

can you give the entire filter ?  
also your regex isn't correct, try this `"(.*\\)" instead of "[*\\]"`

---

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [October 9, 2017, 5:08pm UTC](https://discuss.elastic.co/t/gsub-syntax-to-remove-all-before/103243/3 "2017-10-09T17:08:31Z")

</div>

Thanks for the reply. I'd already tried that particular syntax but still no luck. The full filter is shown below. I'm essentially pulling in a txt file as a key/value pair, mutating some of it and pushing it to Elastic. The UserName field contains either the PC name and the username separated by a \ or the domain name and username in the same format.

```
filter {
  if [type] == "log" {
		kv {
    field_split => ";"
		value_split => "="
		trim_value => "\s"
		}
		
date {
        match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
        target => "@timestamp"
	    timezone => "Europe/London"
     }
	 
mutate {
		gsub => ["UserName", "(.*\\)", ""]
		gsub => ["ComputerIPAddress", "\r", ""]
		remove_field => ["message"]
	}
	}
}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2017, 5:08pm UTC](https://discuss.elastic.co/t/gsub-syntax-to-remove-all-before/103243/4 "2017-11-06T17:08:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.