# Filebeat Nginx module not producing url.domain field if domain contains "\_" (underscore)

**URL:** https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146
**Category:** Beats
**Tags:** filebeat
**Created:** [October 20, 2022, 5:23pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146 "2022-10-20T17:23:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![haikosaw](https://avatars.discourse-cdn.com/v4/letter/h/82dd89/32.png) [@haikosaw](https://discuss.elastic.co/u/haikosaw)
#### Post date: [October 20, 2022, 5:23pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146/1 "2022-10-20T17:23:10Z")

</div>

Hello.

I´m having an issue where I'm using the Nginx module in Filebeat 8.4.2 (via ES\_Agent and Fleet).  
After searching for a while why sometimes I would get the url.domain field, and sometimes not, I noticed that whenever the url has an underscore "\_" in the host name (url.domain) it does not index the url.domain field at all. I'm guessing it's a parsing error.

Here's an example to visualize what I mean:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fbadba8c24b424d3076c19a22c1b01afcba8e018.png)

I know underscores are not recomended in hostnames, but can someone confirm if this is by design or if it's a bug in the Nginx module?  
Thanks!

---

<div class="post-metadata">

### Author: ![Lee\_Hinman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lee_hinman/32/74973_2.png) [@Lee\_Hinman](https://discuss.elastic.co/u/Lee_Hinman)
#### Post date: [October 20, 2022, 7:27pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146/2 "2022-10-20T19:27:45Z")

</div>

It is expected behavior. The `url.domain` field is being populated by the [uri\_parts processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/uri-parts-processor.html), and internally that uses the Java [java uri getHost function](https://docs.oracle.com/javase/7/docs/api/java/net/URI.html#getHost()) to parse the uri. And that function has the following constraint:

" A domain name consisting of one or more _labels_ separated by period characters ('.'), optionally followed by a period character. Each label consists of _alphanum_ characters as well as hyphen characters ('-'), though hyphens never occur as the first or last characters in a label. The rightmost label of a domain name consisting of two or more labels, begins with an _alpha_ character."

And this conforms to [RFC2396](https://www.ietf.org/rfc/rfc2396.txt)

---

<div class="post-metadata">

### Author: ![haikosaw](https://avatars.discourse-cdn.com/v4/letter/h/82dd89/32.png) [@haikosaw](https://discuss.elastic.co/u/haikosaw)
#### Post date: [October 20, 2022, 7:46pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146/3 "2022-10-20T19:46:42Z")

</div>

Thank you very much for clearing that up.  
I guess I will derive the hostname from another source then, and let those responsible know not to use "\_". 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 17, 2022, 9:47pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146/4 "2022-11-17T21:47:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.