# Parsing IIS log - remove part of string

**URL:** <https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142>\
**Category:** Logstash\
**Created:** [October 8, 2017, 7:52am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142 "2017-10-08T07:52:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\
**Post date:** [October 8, 2017, 7:52am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142/1 "2017-10-08T07:52:26Z")

</div>

Hi,

I have IIS log, example :  
2017-10-01 08:29:30 10.70.4.52 GET /Lists/NewsFeed/AllItems.aspx AjaxDelta=1 80 0#.w|mad\sp3\_dev 10.70.4.52 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.2;+WOW64;+Trident/6.0;+.NET4.0E;+.NET4.0C;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729) [http://sppanoramadev/Shared%20Documents/Forms/AllItems.aspx](http://sppanoramadev/Shared%20Documents/Forms/AllItems.aspx) 200 0 0 327

grok line I'm running is:  
"%{TIMESTAMP\_ISO8601:log\_timestamp} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{POSINT:port} %{NOTSPACE:username} %{IP:clientIP} %{NOTSPACE:userAgent} %{URI:URL} %{NUMBER:response}"

the username output is "0#.w|mad\sp3\_dev"  
I need o parse only the username without all the characters and domain name "0#.w|mad"  
This "|" is a pipe line character.

how can I do it?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 8, 2017, 8:00am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142/2 "2017-10-08T08:00:40Z")

</div>

You could use the KV filter on that `|` to split it, then throw away the first part.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 8, 2017, 9:07am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142/3 "2017-10-08T09:07:54Z")

</div>

Duplicate of [Grok username in iis log](https://discuss.elastic.co/t/grok-username-in-iis-log/102543).

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 8, 2017, 9:21am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142/4 "2017-10-08T09:21:16Z")

</div>

Thanks, we'll close this one in favour of that one as it's the original 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 8, 2017, 9:21am UTC](https://discuss.elastic.co/t/parsing-iis-log-remove-part-of-string/103142/5 "2017-10-08T09:21:19Z")

</div>