# Extract server name from fqdn
**URL:** https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503
**Category:** Logstash
**Created:** [March 21, 2020, 4:15am UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503 "2020-03-21T04:15:22Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)
#### Post date: [March 21, 2020, 4:15am UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503/1 "2020-03-21T04:15:22Z")
in beat.hostname, some are in CAPS / small , lower /upper case characters .
To stabilize the search, i want to extract server name without fqdn and store in new field in lower case i tried following
1. mutate {
split =\> { "beat.Hostname" =\> "." }
add\_field =\> { "host1" =\> "%{[beat][Hostname][1]}" }
lowercase =\> ["host1"]
}
2. mutate {
add\_field =\> { "host2" =\> "beat.Hostname"]
split =\> { "host2" =\> "." }
add\_field =\> { "host1" =\> "%{host2[0]}" }
lowercase =\> ["host1"]
}
but in both cases host1 value %{[beat][Hostname][1]}" or "%{host2[0]}" or in elk
Am i missing anything
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 22, 2020, 4:46pm UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503/2 "2020-03-22T16:46:13Z")
> [@vijay\_kaali](#):
>
> split =\> { "beat.Hostname" =\> "." }
> add\_field =\> { "host1" =\> "%{[beat][Hostname][1]}" }
If the field name contains a period you would refer to it as beat.hostname. If the beat field is an object that contains a Hostname field then you would refer to it as [beat][Hostname]. I suspect you need to update your split option.
---
### Author:  [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)
#### Post date: [March 23, 2020, 1:44pm UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503/3 "2020-03-23T13:44:43Z")
// add\_field =\> { "host1" =\> "%{beat.Hostname[1]}" } //
This setting throws error
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 23, 2020, 2:49pm UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503/4 "2020-03-23T14:49:12Z")
Is the beat field an object that contains a hostname field, or is the field named beat.hostname?
---
### Author:  [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)
#### Post date: [April 14, 2020, 4:45am UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503/5 "2020-04-14T04:45:22Z")
I am able to do this via workaround
copy nesting field to temp field
add field host1 \> beat.hostname
split field host1 , "."
add\_field shhost \> host1[0]
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 12, 2020, 4:45am UTC](https://discuss.elastic.co/t/extract-server-name-from-fqdn/224503/6 "2020-05-12T04:45:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.