# Help with regex/grok
**URL:** https://discuss.elastic.co/t/help-with-regex-grok/41529
**Category:** Logstash
**Created:** [February 11, 2016, 5:15pm UTC](https://discuss.elastic.co/t/help-with-regex-grok/41529 "2016-02-11T17:15:31Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@l1carter](https://discuss.elastic.co/u/l1carter)
#### Post date: [February 11, 2016, 5:15pm UTC](https://discuss.elastic.co/t/help-with-regex-grok/41529/1 "2016-02-11T17:15:31Z")
sample line:
SOMETEXTBEFORE... UserName=jsmith, CmdSet=[CmdAV=show CmdArgAV=running-config CmdArgAV=interfaces CmdArgAV=Port-Channel1 CmdArgAV=], Protocol=Tacacs, MatchedCommandSet=AllowAllCommands, SOMETEXTAFTER...
what I'm hoping to do is pull from the above:
message = entire string above so GREEDYDATA...
add "username" = jsmith
add "command" = show running-config interfaces Port-Channel1
so... I'm pretty sure I could get the username... with
%{GREEDYDATA}UserName=%{WORD:username},
but how do I remove all the "CmdArgAV=" ect... there will be anywhere from 1 to many "CmdArgAV" depending on what command the user ran... they can run "who" and there's only 1 instance or they can run what I did and there's 4 of them...
thoughts or suggestions appreciated.
thanks,
Lee
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 14, 2016, 2:45pm UTC](https://discuss.elastic.co/t/help-with-regex-grok/41529/2 "2016-02-14T14:45:19Z")
You should be able to use `mutate { gsub => [...] }` to remove all occurences of "CmdArgAV=" in the string in between the square brackets.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/help-with-regex-grok/41529/3 "2017-07-06T05:11:38Z")