Extract domains from a string of email address

Elastic Stack Logstash
1

I have a field "to_domains_temp" (copied from email recipients list, amount of email addresses is unpredictable), let's say "akii.suzuki@gmail.com;machael.miki@hotmail.com;nobuo.miki@outlook.com;wakako.seki@gmail.com"
how do I extract all the domains from the field? I tried below approach but seems like gsub does not work. Please kindly advise.

filter {
gsub => [
"to_domains_temp", "(\W|^)[\w.+-]{0,100}@", ";prefix@" #match and replace email prefix with ";prefix@"
]
kv {field_split => ";" value_split => "@" source => "to_domains_temp" target => "to_domains" allow_duplicate_values => false}
rename => {"to_domains.prefix" => "to_domain"}
}

2 
    mutate { split => { "domains" => ";" } }
    mutate { gsub => [ "domains", ".*@", "" ] }
    ruby { code => 'event.set("domains", event.get("domains").uniq)' }
1 Like
3

Thanks Badger. It works like a charm:smiley:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.