Split email address from existing field into new field without changing original field

Elastic Stack Logstash
1

I have a working grok filter for a log file just like I want it. Currently the full email is currently parsed into a single field I call "user". I do not want to split this in the original grok unless I have to. I would like to strip the username portion of an email address before the @ and store it in a new field called "uid". I know that mutate has a split option, but it splits the content of the original field which I would prefer not to have happen. Initially tried:

 mutate {
    split => {"user" => "@"}
    add_field => {"uid" => "%{user[0]}"}
   }

As discovered, this one changes the original field which I do not want, and for some reason this does not add a field called "uid" for some reason. Could use some further advice. Thank you.

2

Why not use a second grok to extract the username from the email?

"%{user[0]}" should be "%{[user][0]}"

3

Thanks as usual Badger, seems the documentation on syntax has some typos.

As to your question why not use a second grok, I am not totally clear on what you mean. I don't know how to grok the fields of a message that have already been "groked" so to speak. That sounds like an ideal solution though. Currently the "user" field is parsed using the %EMAILADDRESS pattern and works well and I want to maintain that field, but for other reasons it would be nice to be able to search on just the username portion of that field.

4

Just use a second grok to split the [user] field.

input { generator { count => 1 lines => [ 'Email address: user@example.com' ] } }
filter {
    grok { match => { "message" => '%{EMAILADDRESS:user}' } }
    grok { match => { "user" => '%{USERNAME:uid}@' } }
}
5

Another point for Badger. Worked 100% as expected. Thank you again. Also exposed a serious misunderstanding on my part as to how I thought these filters worked.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.