# Remove domain from username

**URL:** <https://discuss.elastic.co/t/remove-domain-from-username/318464>\
**Category:** Logstash\
**Created:** [November 8, 2022, 6:25pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464 "2022-11-08T18:25:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aivazisd](https://avatars.discourse-cdn.com/v4/letter/a/c4cdca/32.png) [@aivazisd](https://discuss.elastic.co/u/aivazisd)\
**Post date:** [November 8, 2022, 6:25pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464/1 "2022-11-08T18:25:55Z")

</div>

Working with a string:

user-identity: Delete IP-User mapping 555.55.55.555 - LOCAL\user Succeeded - VPN user logout

I'm trying to extract the user field without the 'LOCAL'. I can capture the IP and string 'logout' for the session, but not having success with removing the domain from the user. Each log is the same with it coming through as LOCAL.

Any help is appreciated.

Thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 8, 2022, 6:31pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464/2 "2022-11-08T18:31:13Z")

</div>

> [@aivazisd](#):
>
> I'm trying to extract the user field

How? Are you using grok? dissect? Something else? What have you tried?

---

<div class="post-metadata">

**Author:** ![aivazisd](https://avatars.discourse-cdn.com/v4/letter/a/c4cdca/32.png) [@aivazisd](https://discuss.elastic.co/u/aivazisd)\
**Post date:** [November 8, 2022, 7:04pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464/3 "2022-11-08T19:04:11Z")

</div>

Using grok and I've tried so far; %{GREEDYDATA} %{IPV4:ip} %{GREEDYDATA} %{GREEDYDATA:user} %{GREEDYDATA} %{GREEDYDATA} %{GREEDYDATA} %{GREEDYDATA} %{GREEDYDATA:session}

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 8, 2022, 7:09pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464/4 "2022-11-08T19:09:28Z")

</div>

> [@aivazisd](#):
>
> user-identity: Delete IP-User mapping 555.55.55.555 - LOCAL\user Succeeded - VPN user logout

What does your entire message looks like. This is from Cisco ASA, right?

I use the following dissect to parse ASA log messages.

First I get the log id and message in different fields.

```auto
dissect {
    mapping => {
        "message" => "<%{}>%{timestamp}%%{[cisco][log][id]}:%{[cisco][log][message]}"
    }
    remove_field => ["message"]
}
mutate {
    strip => ["timestamp","[cisco][log][message]"]
}

```

Then I filter each log id and use a dissect, in this case it would be:

```auto
if [cisco][log][id] == "ASA-7-746013" {
    dissect {
        mapping => {
            "[cisco][log][message]" => "user-identity: Delete IP-User mapping %{[user][ip]} - %{[user][name]} %{} - %{[session][reason]}"
        }
    }
}

```

This would give me the field `user.name` with the value `LOCAL\user`, to get only the user I use a mutate filter.

```auto
mutate {
    gsub => [
        "[user][name]","[\\]" ,"",
        "[user][name]","LOCAL" ,""
    ]
}

```

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [November 9, 2022, 3:05pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464/5 "2022-11-09T15:05:29Z")

</div>

You can use grok to parse your log

> user-identity: Delete IP-User mapping 192.168.0.1 - LOCAL\user Succeeded - VPN user logout

I just chaned correct IP format  
Here is example of grok config

```auto
user-identity: %{WORD:action.name} IP-User mapping %{IP:user.ip} - %{WORD}\\%{USERNAME:user.name} %{WORD:action.status} - VPN user %{WORD:session.status}

```

The output looks like this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5dac2f0df52c5ce47c58856334f3206d873bbd61.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2022, 3:06pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464/6 "2022-12-07T15:06:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.