Grok match an fqdn

Elastic Stack Logstash
1

Hello,

I am a newbie for grok and patterns. I have been trying to grok parse an fqdn entry which has variable length - multiple dots (.) and uses dashes (-) and underscore (__) for the hostnames. The DNS entries could something like (Note it has an extra dot at the end as this came from a DNS request)

us-courier.push-apple.com.akadns.net.
p14-ckdatabase-current.edge.icloud.apple-dns.net.
ynuf.alibaba.com.gds.alibabadns.com.
googlehosted.googleusercontent.com.

what is trying to get is the last 2 entries, so that I can extract say for these entries
akadns.net
apple-dns.net
alibabadns.com
googleusercontent.com

(in some cases I need 3 for gov.uk domains)

Here, I cannot use the WORD pattern as some characters are not included. This match works for the when I tested to get the first entry only.
match => ["dns_query", "(?[A-Za-z0-9_-]+)"]

When I tried expanding it, I cannot get it to work with this when expanded
match => ["dns_query", "(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+)"]
match => ["dns_query", "(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+)"]
match => ["dns_query", "(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+)"]
match => ["dns_query", "(?[A-Za-z0-9_-]+).(?[A-Za-z0-9_-]+)"]

As it only used the first match statement.

Any advise what I am doing it wrong?

Thanks!

2

Perhaps something like this to capture the two last domain name components except for gov.uk domains where you capture the three last?

\.(?<domain>[A-Za-z0-9_-]+\.gov\.uk)$
\.(?<domain>[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$
3

Thanks Magnus,

I tried this in the grok match statement

match => ["dns_query", "\.(?\<domain\>[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$"]

and I got a [0] "_grokparsefailure"

 "dns_query" => "p14-keyvalueservice-current.edge.icloud.apple-dns.net.",
      "tags" => [
[0] "_grokparsefailure"

Any ideas?

4

Don't escape the angle brackets.

I forgot that you have a period at the end of the input domain which I didn't take into account in my suggestion.