# How to filter username data from the field of request , using scripted\_field **URL:** \ **Category:** Kibana\ **Created:** [September 18, 2018, 4:07am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912 "2018-09-18T04:07:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mark.quilates](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark.quilates/32/24802_2.png) [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Post date:** [September 18, 2018, 4:07am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/1 "2018-09-18T04:07:59Z")
Hi Guys, Can help me solve my concern to filter username data thru **scripted\_field** **username** is located in the request\_field of COMBINEAPACHE. Example: /api/v2/members/ **y23228020** /wallets/0/balance .... /api/v2/members/ **py51171** /wallets .... ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 18, 2018, 6:29am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/2 "2018-09-18T06:29:09Z")
Extracting this at search time for every document may be quite slow. I would recommend instead extracting and storing this in a separate field before the document is indexed into Elasticsearch. That will scale and perform much better. ---
**Author:** ![mark.quilates](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark.quilates/32/24802_2.png) [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Post date:** [September 18, 2018, 8:30am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/3 "2018-09-18T08:30:08Z")
Okay, so, what you mean here is, filtering should be done in the logstash level? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 18, 2018, 8:37am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/4 "2018-09-18T08:37:27Z")
Yes, extract it in Logstash. ---
**Author:** ![mark.quilates](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark.quilates/32/24802_2.png) [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Post date:** [September 18, 2018, 9:37am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/5 "2018-09-18T09:37:15Z")
@Christian_Dahlqvist Can you help me how to achieved that? Any idea please, since I don't have much knowledge how to do that. How to segregate the **request** field data and I'm using COMBINEAPACHE. Something like user-agent output separated the OS name and version etc. Thanks in advance. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 18, 2018, 9:45am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/6 "2018-09-18T09:45:37Z")
I think you will need to add a grok filter that extracts the relevant part from the `request` field. ---
**Author:** ![mark.quilates](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark.quilates/32/24802_2.png) [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Post date:** [September 19, 2018, 3:53am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/7 "2018-09-19T03:53:03Z")
Hi @Christian_Dahlqvist, Its all good now. thanks for your idea. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 17, 2018, 3:53am UTC](https://discuss.elastic.co/t/how-to-filter-username-data-from-the-field-of-request-using-scripted-field/148912/8 "2018-10-17T03:53:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.