Filebeat Nginx module not producing url.domain field if domain contains "_" (underscore)

It is expected behavior. The url.domain field is being populated by the uri_parts processor, and internally that uses the Java java uri getHost function to parse the uri. And that function has the following constraint:

" A domain name consisting of one or more labels separated by period characters ('.'), optionally followed by a period character. Each label consists of alphanum characters as well as hyphen characters ('-'), though hyphens never occur as the first or last characters in a label. The rightmost label of a domain name consisting of two or more labels, begins with an alpha character."

And this conforms to RFC2396

1 Like