# Logstash Filtering split

**URL:** <https://discuss.elastic.co/t/logstash-filtering-split/176956>\
**Category:** Logstash\
**Created:** [April 15, 2019, 6:50pm UTC](https://discuss.elastic.co/t/logstash-filtering-split/176956 "2019-04-15T18:50:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [April 15, 2019, 6:50pm UTC](https://discuss.elastic.co/t/logstash-filtering-split/176956/1 "2019-04-15T18:50:10Z")

</div>

How would I filter "fileWriteEvent/username": "domain\bob132" so that I can create a new field  
( basically taking out hte domain\)  
Username: bob132

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2019, 7:30pm UTC](https://discuss.elastic.co/t/logstash-filtering-split/176956/2 "2019-04-15T19:30:00Z")

</div>

```
    mutate { add_field => { "username" => "domain\bob132" } }
    mutate { gsub => ["username", ".*[\\]", "" ] }
```

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [April 15, 2019, 7:36pm UTC](https://discuss.elastic.co/t/logstash-filtering-split/176956/3 "2019-04-15T19:36:21Z")

</div>

That mutate gsub statement is what i needed. Thank you! . Can you explain that syntax

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2019, 8:03pm UTC](https://discuss.elastic.co/t/logstash-filtering-split/176956/4 "2019-04-15T20:03:28Z")

</div>

It says to match zero or more of any-character, followed by one character of the group containing backslash.

Trying to get a single backslash into the configuration can be a challenge. This is a standard trick used in mutate+gsub.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2019, 8:03pm UTC](https://discuss.elastic.co/t/logstash-filtering-split/176956/5 "2019-05-13T20:03:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.