Good morning, I'm pretty newbie about ELK.
I'm trying to use ELK to analyze DNS query log.
I would like to add a field created splitting another field.
I have a field like this:
"query" => "clients1.google.com.",
I want to generate a new one like "domain" => "google.com"
How can we do it?