# Extract subdomain from referrer in logstash
**URL:** https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729
**Category:** Logstash
**Created:** [May 29, 2018, 5:27pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729 "2018-05-29T17:27:23Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Med](https://discuss.elastic.co/u/Med)
#### Post date: [May 29, 2018, 5:27pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/1 "2018-05-29T17:27:24Z")
I use logstash to send apache log to elasticsearch. In the file config of logstash I have a filter
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}
}
In the list of fields of the obtained data I have the field "referrer" of which I would like to extract the subdomain. If for example:
referrer = "[http://mysubdomain.mydomain.com/controller/action](http://mysubdomain.mydomain.com/controller/action)"
then i need to extract the string "mysubdomain" and assign it to a new "subdomain" field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 29, 2018, 6:05pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/2 "2018-05-29T18:05:03Z")
Use grok and match against
```
"https?://(?[^/]+)\.[^\./]+\.[^\./]+/"
```
Updated to name subdomain instead of domain.
---
### Author:  [@Med](https://discuss.elastic.co/u/Med)
#### Post date: [May 29, 2018, 6:56pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/3 "2018-05-29T18:56:20Z")
I'm new to logstash. If you can tell me how to complete my grok it will be nice of you 🙂
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}
}
grok {
match =\> ???
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 29, 2018, 7:04pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/4 "2018-05-29T19:04:10Z")
```auto
grok { match => ["referrer", "https?://(?[^/]+)\.[^\./]+\.[^\./]+/" ] }
```
should do it.
---
### Author:  [@Med](https://discuss.elastic.co/u/Med)
#### Post date: [May 29, 2018, 7:14pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/5 "2018-05-29T19:14:49Z")
Don't works for me. The referrer is variable:
referrer = "[http://mysubdomain.mydomain.com/controller/action](http://mysubdomain.mydomain.com/controller/action)"
referrer = "[http://mysubdomain.mydomain.com/controller/action/param](http://mysubdomain.mydomain.com/controller/action/param)..."
referrer = "[http://mysubdomain.mydomain.com](http://mysubdomain.mydomain.com)"
And I can have https or http.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 29, 2018, 7:45pm UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/6 "2018-05-29T19:45:49Z")
It already handles https. If the trailing / is optional then use
```
grok { match => ["referrer", "https?://(?[^/]+)\.[^\./]+\.[^\./]+(/|$)" ] }
```
---
### Author:  [@Med](https://discuss.elastic.co/u/Med)
#### Post date: [May 30, 2018, 1:24am UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/7 "2018-05-30T01:24:26Z")
It works. Thanks 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2018, 1:24am UTC](https://discuss.elastic.co/t/extract-subdomain-from-referrer-in-logstash/133729/8 "2018-06-27T01:24:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.