I´m having an issue where I'm using the Nginx module in Filebeat 8.4.2 (via ES_Agent and Fleet).
After searching for a while why sometimes I would get the url.domain field, and sometimes not, I noticed that whenever the url has an underscore "_" in the host name (url.domain) it does not index the url.domain field at all. I'm guessing it's a parsing error.
Here's an example to visualize what I mean:
I know underscores are not recomended in hostnames, but can someone confirm if this is by design or if it's a bug in the Nginx module?
It is expected behavior. The
url.domain field is being populated by the uri_parts processor, and internally that uses the Java java uri getHost function to parse the uri. And that function has the following constraint:
" A domain name consisting of one or more labels separated by period characters ('.'), optionally followed by a period character. Each label consists of alphanum characters as well as hyphen characters ('-'), though hyphens never occur as the first or last characters in a label. The rightmost label of a domain name consisting of two or more labels, begins with an alpha character."
And this conforms to RFC2396
Thank you very much for clearing that up.
I guess I will derive the hostname from another source then, and let those responsible know not to use "_".
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.