# Extract domain with grok
**URL:** https://discuss.elastic.co/t/extract-domain-with-grok/103156
**Category:** Logstash
**Created:** [October 8, 2017, 4:29pm UTC](https://discuss.elastic.co/t/extract-domain-with-grok/103156 "2017-10-08T16:29:48Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Shoham\_Ben\_Shitrit](https://discuss.elastic.co/u/Shoham_Ben_Shitrit)
#### Post date: [October 8, 2017, 4:29pm UTC](https://discuss.elastic.co/t/extract-domain-with-grok/103156/1 "2017-10-08T16:29:48Z")
I'd like to make the simplest grok filter, just to extract domain from url For example, for the url
`https://discuss.elastic.co/top/all`
I'd like to get the result
`discuss.elastic.co`
I tried to do so with the filter
`%{URIPROTO}://%{URIHOST:domain}`
And it did extract me [stackoverflow.com](http://stackoverflow.com), but when I use a different url that has www at the start for example `https://www.elastic.co/`
the result is
`www.elastic.co`
is there a filter that could return me the domain alone, without www?
Thank you!
---
### Author:  [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)
#### Post date: [October 10, 2017, 8:54am UTC](https://discuss.elastic.co/t/extract-domain-with-grok/103156/2 "2017-10-10T08:54:46Z")
after your grok you could add a mutate like this :
`mutate { gsub => ["domain", "(www.)", ""] }`
if there is the pattern "www." then it should be replaced by "" and if there isn't the pattern then nothing is made
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 7, 2017, 8:55am UTC](https://discuss.elastic.co/t/extract-domain-with-grok/103156/3 "2017-11-07T08:55:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.