Extract domain from field

Elastic Stack Logstash
1

I want to extract domain from email field that is like this:

smtp.from_mail : "news <newsletters@example.com>"

I would like to use grok or other useful plugin.

2

Someone can help me?

3

smtp.from_mail : "news \<%{DATA:user}\@%{DATA:domain}\>"

on logstash use

  grok {
    match => [ 'message', 'smtp.from_mail : "news \<%{DATA:user}\@%{DATA:domain}\>"' ]
  }

You can build or test your own grok statements on:

https://grokdebug.herokuapp.com/ or Kibana Grok plugin

4

Thanks for your reply,
I tried but when I try to print the field domain with stdout plugin it seems don't work..

output{
if [event] == "smtp" {
stdout {
codec => line { format =>"%{[smtp][from]} - %{[domain]} - %{maildomain} - %[maildomain] - %maildomain" }
}
}

I see this results
test@example.com - %{[domain]} - %{domain} - %[domain] - %domain

I tried all combinations to print domain but without success.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.