# Parsing an existing field further

**URL:** <https://discuss.elastic.co/t/parsing-an-existing-field-further/281389>\
**Category:** Logstash\
**Created:** [August 13, 2021, 4:47pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389 "2021-08-13T16:47:25Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [August 13, 2021, 4:47pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/1 "2021-08-13T16:47:25Z")

</div>

Hi,  
Is there way to parse the data from a single filed into 2 different fields? I have a field that contains a username and an ID that I would like to break out. So I want to assign to keep the username in the username field but then remove the numbers and assign it to a say UserID field. I have tried with grok to break it out further but it doesnt get picked up. I dont get an error, it just doent get picked up

so for example  
username: Test,User  
UserID: 1234567

Right now its all in the username field  
"username" : "1234567,TEST,USER"

The log is as follows:

```auto
{
  "TestABC" : {
    "dataRec" : {
      "eventName" : "IN",
      "date" : "210721",
      "time" : "07:19:56",
      "userName" : "1234567,TEST,USER "
    }
  }
}

```

My filter is as follows:

```auto
filter {
  json {
    source => "message"
    remove_field => "message"
    remove_field => "host"
           }
       
mutate {

    rename => {"[TestABC][dataRec][userName]" => "sourceUserName"}
    rename => {"[TestABC][dataRec][date]" => "date"}
    rename => {"[TestABC][dataRec][time]" => "time"}
    
    add_field => {"start" => "%{date} %{time}"}
    add_field => {"end" => "%{date} %{time}"}
    remove_field => ["date", "time"]
     }
     
grok
       {
        match => { "sourceUsername" => ["%{NUMBER:UserID"] }
       }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 13, 2021, 5:57pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/2 "2021-08-13T17:57:59Z")

</div>

If you use

```
output { stdout { codec => rubydebug } }

```

then what does the resulting event look like?

---

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [August 13, 2021, 7:50pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/3 "2021-08-13T19:50:46Z")

</div>

Hi,  
It looks like this

```auto

{
          "path" => "/home/log.txt",
       "TestABC" => {
        "dataRec" => {
                 "time" => "07:19:56",
            "eventName" => "IN",
                 "date" => "210721",
             "userName" => "1234567,TEST,USER "
        }
    },
    "@timestamp" => 2021-08-13T19:49:17.553Z,
          "tags" => [
        [0] "multiline",
        [1] "_grokparsefailure"
    ],
      "@version" => "1"
}

```

---

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [August 13, 2021, 8:00pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/4 "2021-08-13T20:00:18Z")

</div>

If I remove the grok code it removes the \_grokparsefailure so that's obviously not the proper way forward to break out the userName field further.

```auto
    "@timestamp" => 2021-08-13T19:58:12.592Z,
          "path" => "/home/new20.txt",
          "tags" => [
        [0] "multiline"
    ],
       "TestABC" => {
        "dataRec" => {
            "eventName" => "IN",
                 "time" => "07:19:56",
             "userName" => "1234567,TEST,USER ",
                 "date" => "210721"
        }
    },
      "@version" => "1"
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 13, 2021, 8:32pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/5 "2021-08-13T20:32:46Z")

</div>

The mutate+rename is not happening. Not sure why, but that is why you cannot parse [sourceUsername]

---

<div class="post-metadata">

**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\
**Post date:** [August 13, 2021, 11:53pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/6 "2021-08-13T23:53:05Z")

</div>

I got it to work. I forgot to take in account the "nesting". It works with the following

```auto
filter {
  json {
    source => "message"
    remove_field => "message"
    remove_field => "host"
           }
grok
       {
        match => { "[TestABC][dataRec][userName]" => ["%{BASE16NUM:employeeID}\,%{GREEDYDATA:User}"] }
       }
}

```

RESULTS

```auto
{
           "TestABC" => {
        "dataRec" => {
            "eventName" => "IN",
             "userName" => "123456,TEST,USER ",
                 "date" => "210721",
                 "time" => "07:19:56"
        }
    },
        "employeeID" => "123456",
        "@timestamp" => 2021-08-13T23:51:33.679Z,
              "tags" => [
        [0] "multiline"
    ],
              "path" => "/home/test.log",
          "@version" => "1",
    "sourceUserName" => "TEST,USER "
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2021, 11:53pm UTC](https://discuss.elastic.co/t/parsing-an-existing-field-further/281389/7 "2021-09-10T23:53:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.