I have a working grok filter for a log file just like I want it. Currently the full email is currently parsed into a single field I call "user". I do not want to split this in the original grok unless I have to. I would like to strip the username portion of an email address before the @ and store…

Just use a second grok to split the [user] field. input { generator { count => 1 lines => [ 'Email address: user@example.com' ] } } filter { grok { match => { "message" => '%{EMAILADDRESS:user}' } } grok { match => { "user" => '%{USERNAME:uid}@' } } }

Split email address from existing field into new field without changing original field

Elastic Stack Logstash

hueyg September 16, 2019, 8:10pm 5

Another point for Badger. Worked 100% as expected. Thank you again. Also exposed a serious misunderstanding on my part as to how I thought these filters worked.

Topic		Replies	Views
Clean and split email address into two new fields Logstash ingest-pipeline	4	456	April 14, 2021
Parsing an existing field further Logstash	6	435	September 10, 2021
Extract string from a field in logstash Logstash	8	5083	December 12, 2019
Strip in mutate filter Logstash	3	1159	March 14, 2019
Splitting a data field into two Elasticsearch	6	8670	July 12, 2017

Split email address from existing field into new field without changing original field

Related topics