Extracting string from a mesage

Graylog Central (peer support)
1

HI Guys,

I’m struggle to extract a username from the full message but i really cannot figure how to. The message looks like:
“could not obtain user info (andrew.charles)”
and what i want is to add a separate field (USERS) which can filter all this users.
Any idea how to solve this issue?
Thanks a lot
Laurentiu

2

You could use GROK or regex to pull that out.

It is hard to offer help without knowing much about your environment… I don’ t know if you are using extractors or functions in the pipeline… Here are some links to read about how to ask questions and explain your environment - maybe reading through those you can explain a little better about your environment and what you have tried?

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.