I am trying to parse out unwanted domain data from a user field that is already being parsed in the parser extension. So we already have two user variables set [user1] and [user2] and they are being mapped respectively to principal and target user.
The problem I am having is that I want to remove “domain\\” from “domain\\username” but I cannot figure out how.
Current output from bellow parsing “principal.user.userid"Domain\\username"”
if [User1] != "" {
mutate {
replace => {
"user1_field.key" => "User1"
"user1_field.value" => "%{User1}"
}
on_error => "failed_to_map_User1"
}
if ![failed_to_map_User1] {
mutate {
merge => {
"target.resource.attribute.labels" => "user1_field"
}
on_error => "failed_to_merge_User1"
}
}
mutate {
replace => {
"principal.user.userid" => "%{User1}"
}
on_error => "failed_to_map_User1_to_user"
}
}
if [User2] != "" {
if [User1] == "" {
mutate {
replace => {
"principal.user.userid" => "%{User2}"
}
on_error => "failed_to_map_User2"
}
}
else {
mutate {
replace => {
"user2_field.key" => "User2"
"user2_field.value" => "%{User2}"
}
on_error => "failed_to_map_User2"
}
if ![failed_to_map_User2] {
mutate {
merge => {
"principal.user.attribute.labels" => "user2_field"
}
on_error => "failed_to_merge_User2"
}
}
}
}
