Any way to parse "${user.name}" when doing document based security?

I’m trying to take a substring from the “${user.name}” that arrives, and then inflict it on the index.
for example, my users are external, and are constructed through AWS (IAM):
arn:aws:iam::1234567:role/user_admin

this is the value that i get on the ${user.name} field, but i want to parse it and actually take only the “admin” section, and then all my documents will have a relevant field, right now what i’m doing:

{
  "match": {
    "owned_by": "${user.name}"
  }
}

but of course i don’t want to put the entire ARN, maybe perform some kind of regex on that field?

Hi @fejo135 can you confirm if you are using SAML, OIDC etc. and also the version f odfe you are using.