# Advanced field manipulation

**URL:** <https://discuss.elastic.co/t/advanced-field-manipulation/59515>\
**Category:** Logstash\
**Created:** [September 1, 2016, 8:38am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515 "2016-09-01T08:38:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lorenzo\_Mainardi](https://avatars.discourse-cdn.com/v4/letter/l/fbc32d/32.png) [@Lorenzo\_Mainardi](https://discuss.elastic.co/u/Lorenzo_Mainardi)\
**Post date:** [September 1, 2016, 8:38am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515/1 "2016-09-01T08:38:34Z")

</div>

Good morning, I'm pretty newbie about ELK.  
I'm trying to use ELK to analyze DNS query log.  
I would like to add a field created splitting another field.

I have a field like this:

"query" =\> "[clients1.google.com](http://clients1.google.com).",

I want to generate a new one like "domain" =\> "[google.com](http://google.com)"

How can we do it?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 1, 2016, 8:55am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515/2 "2016-09-01T08:55:08Z")

</div>

Do you always want to extract the two last labels in the DNS name? What about [clients1.google.co.uk](http://clients1.google.co.uk)?

---

<div class="post-metadata">

**Author:** ![Lorenzo\_Mainardi](https://avatars.discourse-cdn.com/v4/letter/l/fbc32d/32.png) [@Lorenzo\_Mainardi](https://discuss.elastic.co/u/Lorenzo_Mainardi)\
**Post date:** [September 1, 2016, 9:11am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515/3 "2016-09-01T09:11:18Z")

</div>

I did not thought about this kind of problem.  
How can I extract 3 fields?

Do you have any other suggestion to aggregate this kind of data?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 1, 2016, 9:41am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515/4 "2016-09-01T09:41:15Z")

</div>

> How can I extract 3 fields?

Same way as you'd extract two fields, but how would you know whether to extract two or three?

Anyway, you can use a grok filter to extract parts of strings.

This exact question has come up here in the past. Perhaps you can find it in the archives?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515/5 "2017-07-06T04:40:28Z")

</div>