# Stripping characters from a field and convert to lower case

**URL:** <https://discuss.elastic.co/t/stripping-characters-from-a-field-and-convert-to-lower-case/92850>\
**Category:** Logstash\
**Created:** [July 12, 2017, 5:28pm UTC](https://discuss.elastic.co/t/stripping-characters-from-a-field-and-convert-to-lower-case/92850 "2017-07-12T17:28:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bds\_Vince](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@bds\_Vince](https://discuss.elastic.co/u/bds_Vince)\
**Post date:** [July 12, 2017, 5:28pm UTC](https://discuss.elastic.co/t/stripping-characters-from-a-field-and-convert-to-lower-case/92850/1 "2017-07-12T17:28:18Z")

</div>

I am importing IIS logs from the SMTP relay service. I have successfully separated out all of the fields in logstash. One of the data fields needs to have excess characters trimmed and then converted to lower case for the report grouping to display correctly.

The field name is cs-uri-query and it contains data like this:  
FROM:[jstrong@domain.com](mailto:jstrong@domain.com)+SIZE=1351  
TO:[distributioncenter-dallas@domain.com](mailto:distributioncenter-dallas@domain.com)  
+TO:[progammers@domain.com](mailto:progammers@domain.com)  
to:[programmers@domain.com](mailto:programmers@domain.com)  
+to:[PROGRAMMERS@DOMAIN.COM](mailto:PROGRAMMERS@DOMAIN.COM)  
=from[npr3@domain.com](mailto:npr3@domain.com)+SIZE=1202

I want to retrieve the email address and convert it to lower case.

I would appreciate some code to try or a link that describes the process.  
TIA

Vince

---

<div class="post-metadata">

**Author:** ![bds\_Vince](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@bds\_Vince](https://discuss.elastic.co/u/bds_Vince)\
**Post date:** [July 12, 2017, 5:30pm UTC](https://discuss.elastic.co/t/stripping-characters-from-a-field-and-convert-to-lower-case/92850/2 "2017-07-12T17:30:30Z")

</div>

ARGH!

The GUI stripped out the "\<" character which marks the start of the email address and the "\<" character that marks the end....

---

<div class="post-metadata">

**Author:** ![bds\_Vince](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@bds\_Vince](https://discuss.elastic.co/u/bds_Vince)\
**Post date:** [July 24, 2017, 10:35pm UTC](https://discuss.elastic.co/t/stripping-characters-from-a-field-and-convert-to-lower-case/92850/3 "2017-07-24T22:35:43Z")

</div>

Ok, I have figured out how to parse the field with grok  
grok {  
match =\> { "CS-URI-Query" =\> "(?[+A-Z]_[:][\<]_)%{EMAILADDRESS:themail}%{GREEDYDATA:DropMe2}"}  
}

This gives me a field, the mail, with the embedded email address. Now on to the next issue....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2017, 10:36pm UTC](https://discuss.elastic.co/t/stripping-characters-from-a-field-and-convert-to-lower-case/92850/4 "2017-08-21T22:36:31Z")

</div>

Closed on August 21, 2017, 10:36pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.