# Split email address from existing field into new field without changing original field

**URL:** <https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477>\
**Category:** Logstash\
**Created:** [September 13, 2019, 8:16pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477 "2019-09-13T20:16:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hueyg](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hueyg](https://discuss.elastic.co/u/hueyg)\
**Post date:** [September 13, 2019, 8:16pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477/1 "2019-09-13T20:16:53Z")

</div>

I have a working grok filter for a log file just like I want it. Currently the full email is currently parsed into a single field I call "user". I do not want to split this in the original grok unless I have to. I would like to strip the username portion of an email address before the @ and store it in a new field called "uid". I know that mutate has a split option, but it splits the content of the original field which I would prefer not to have happen. Initially tried:

```
 mutate {
    split => {"user" => "@"}
    add_field => {"uid" => "%{user[0]}"}
   }

```

As discovered, this one changes the original field which I do not want, and for some reason this does not add a field called "uid" for some reason. Could use some further advice. Thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 13, 2019, 9:46pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477/2 "2019-09-13T21:46:26Z")

</div>

Why not use a second grok to extract the username from the email?

"%{user[0]}" should be "%{[user][0]}"

---

<div class="post-metadata">

**Author:** ![hueyg](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hueyg](https://discuss.elastic.co/u/hueyg)\
**Post date:** [September 16, 2019, 2:07pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477/3 "2019-09-16T14:07:18Z")

</div>

Thanks as usual Badger, seems the documentation on syntax has some typos.

As to your question why not use a second grok, I am not totally clear on what you mean. I don't know how to grok the fields of a message that have already been "groked" so to speak. That sounds like an ideal solution though. Currently the "user" field is parsed using the %EMAILADDRESS pattern and works well and I want to maintain that field, but for other reasons it would be nice to be able to search on just the username portion of that field.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 16, 2019, 3:08pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477/4 "2019-09-16T15:08:59Z")

</div>

Just use a second grok to split the [user] field.

```
input { generator { count => 1 lines => ['Email address: user@example.com'] } }
filter {
    grok { match => { "message" => '%{EMAILADDRESS:user}' } }
    grok { match => { "user" => '%{USERNAME:uid}@' } }
}
```

---

<div class="post-metadata">

**Author:** ![hueyg](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hueyg](https://discuss.elastic.co/u/hueyg)\
**Post date:** [September 16, 2019, 8:10pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477/5 "2019-09-16T20:10:23Z")

</div>

Another point for Badger. Worked 100% as expected. Thank you again. Also exposed a serious misunderstanding on my part as to how I thought these filters worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2019, 8:16pm UTC](https://discuss.elastic.co/t/split-email-address-from-existing-field-into-new-field-without-changing-original-field/199477/6 "2019-10-14T20:16:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.