Filebeat Nginx module not producing url.domain field if domain contains "_" (underscore)

[haikosaw]

Hello.

I´m having an issue where I'm using the Nginx module in Filebeat 8.4.2 (via ES_Agent and Fleet).
After searching for a while why sometimes I would get the url.domain field, and sometimes not, I noticed that whenever the url has an underscore "_" in the host name (url.domain) it does not index the url.domain field at all. I'm guessing it's a parsing error.

Here's an example to visualize what I mean:

I know underscores are not recomended in hostnames, but can someone confirm if this is by design or if it's a bug in the Nginx module?
Thanks!

[Lee_Hinman]

It is expected behavior. The url.domain field is being populated by the uri_parts processor, and internally that uses the Java java uri getHost function to parse the uri. And that function has the following constraint:

" A domain name consisting of one or more labels separated by period characters ('.'), optionally followed by a period character. Each label consists of alphanum characters as well as hyphen characters ('-'), though hyphens never occur as the first or last characters in a label. The rightmost label of a domain name consisting of two or more labels, begins with an alpha character."

And this conforms to RFC2396

[haikosaw]

Thank you very much for clearing that up.
I guess I will derive the hostname from another source then, and let those responsible know not to use "_".