Extract domain with grok

(Shoham Ben Shitrit) #1

I'd like to make the simplest grok filter, just to extract domain from url For example, for the url
I'd like to get the result
I tried to do so with the filter
And it did extract me stackoverflow.com, but when I use a different url that has www at the start for example https://www.elastic.co/
the result is
is there a filter that could return me the domain alone, without www?
Thank you!

(Rodolphe Redouté) #2

after your grok you could add a mutate like this :

mutate { gsub => [ "domain", "(www.)", "" ] }
if there is the pattern "www." then it should be replaced by "" and if there isn't the pattern then nothing is made

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.