# Want to extract username from log and add it into TAG

**URL:** <https://discuss.elastic.co/t/want-to-extract-username-from-log-and-add-it-into-tag/147414>\
**Category:** Logstash\
**Created:** [September 5, 2018, 1:22pm UTC](https://discuss.elastic.co/t/want-to-extract-username-from-log-and-add-it-into-tag/147414 "2018-09-05T13:22:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cleverrocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleverrocks/32/24311_2.png) [@cleverrocks](https://discuss.elastic.co/u/cleverrocks)\
**Post date:** [September 5, 2018, 1:22pm UTC](https://discuss.elastic.co/t/want-to-extract-username-from-log-and-add-it-into-tag/147414/1 "2018-09-05T13:22:46Z")

</div>

Hi,

I have a log with bellow pattern:

`2018-09-05 11:50:56,152 - INFO - 103.8.115.242 - username1 - com.example.test.service.testService - [ajp-nio-8009-exec-9] - /testServiceCall/default/testPage [page=default, component=testComponent, service=testService, method=testMethod] - @OcService.refreshTree`

`2018-09-05 11:50:56,152 - INFO - 103.8.115.242 - username2 - com.example.test.service.testService - [ajp-nio-8009-exec-9] - /testServiceCall/default/testPage [page=default, component=testComponent, service=testService, method=testMethod] - @OcService.refreshTree`

I want to extract the **username1** and **username2** with the help of Grok and add the usernames into username TAG for each log.

Any help is appreciated on this topic.

Thanks,  
Nasir

---

<div class="post-metadata">

**Author:** ![abhiroyg](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)\
**Post date:** [September 5, 2018, 1:44pm UTC](https://discuss.elastic.co/t/want-to-extract-username-from-log-and-add-it-into-tag/147414/2 "2018-09-05T13:44:28Z")

</div>

Checkout the following link to find out what grok patterns are pre-available

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns>

and the following link to test your grok pattern

[http://grokconstructor.appspot.com/do/match#result](http://grokconstructor.appspot.com/do/match#result)

Try out the following grok for your usecase

```
grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} - %{WORD} - %{IP} - %{WORD:username} - %{GREEDYDATA:source}" }
}
```

---

<div class="post-metadata">

**Author:** ![cleverrocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleverrocks/32/24311_2.png) [@cleverrocks](https://discuss.elastic.co/u/cleverrocks)\
**Post date:** [September 12, 2018, 2:34pm UTC](https://discuss.elastic.co/t/want-to-extract-username-from-log-and-add-it-into-tag/147414/3 "2018-09-12T14:34:41Z")

</div>

Thank you @abhiroyg. This helped a lot. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2018, 2:35pm UTC](https://discuss.elastic.co/t/want-to-extract-username-from-log-and-add-it-into-tag/147414/4 "2018-10-10T14:35:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.