# Grok match an fqdn **URL:** \ **Category:** Logstash\ **Created:** [April 14, 2016, 11:12am UTC](https://discuss.elastic.co/t/grok-match-an-fqdn/47373 "2016-04-14T11:12:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![cwgueco](https://avatars.discourse-cdn.com/v4/letter/c/dec6dc/32.png) [@cwgueco](https://discuss.elastic.co/u/cwgueco)\ **Post date:** [April 14, 2016, 11:12am UTC](https://discuss.elastic.co/t/grok-match-an-fqdn/47373/1 "2016-04-14T11:12:06Z")
Hello, I am a newbie for grok and patterns. I have been trying to grok parse an fqdn entry which has variable length - multiple dots (.) and uses dashes (-) and underscore (\_\_) for the hostnames. The DNS entries could something like (Note it has an extra dot at the end as this came from a DNS request) [us-courier.push-apple.com.akadns.net](http://us-courier.push-apple.com.akadns.net). [p14-ckdatabase-current.edge.icloud.apple-dns.net](http://p14-ckdatabase-current.edge.icloud.apple-dns.net). [ynuf.alibaba.com.gds.alibabadns.com](http://ynuf.alibaba.com.gds.alibabadns.com). [googlehosted.googleusercontent.com](http://googlehosted.googleusercontent.com). what is trying to get is the last 2 entries, so that I can extract say for these entries [akadns.net](http://akadns.net) [apple-dns.net](http://apple-dns.net) [alibabadns.com](http://alibabadns.com) [googleusercontent.com](http://googleusercontent.com) (in some cases I need 3 for [gov.uk](http://gov.uk) domains) Here, I cannot use the WORD pattern as some characters are not included. This match works for the when I tested to get the first entry only. match =\> ["dns\_query", "(?[A-Za-z0-9\_-]+)"] When I tried expanding it, I cannot get it to work with this when expanded match =\> ["dns\_query", "(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+)"] match =\> ["dns\_query", "(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+)"] match =\> ["dns\_query", "(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+)"] match =\> ["dns\_query", "(?[A-Za-z0-9\_-]+).(?[A-Za-z0-9\_-]+)"] As it only used the first match statement. Any advise what I am doing it wrong? Thanks! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 14, 2016, 11:21am UTC](https://discuss.elastic.co/t/grok-match-an-fqdn/47373/2 "2016-04-14T11:21:06Z")
Perhaps something like this to capture the two last domain name components except for [gov.uk](http://gov.uk) domains where you capture the three last? ```nohighlight \.(?[A-Za-z0-9_-]+\.gov\.uk)$ \.(?[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$ ``` ---
**Author:** ![cwgueco](https://avatars.discourse-cdn.com/v4/letter/c/dec6dc/32.png) [@cwgueco](https://discuss.elastic.co/u/cwgueco)\ **Post date:** [April 14, 2016, 11:38am UTC](https://discuss.elastic.co/t/grok-match-an-fqdn/47373/3 "2016-04-14T11:38:47Z")
Thanks Magnus, I tried this in the grok match statement `match => ["dns_query", "\.(?\[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$"]` and I got a [0] "\_grokparsefailure" ``` "dns_query" => "p14-keyvalueservice-current.edge.icloud.apple-dns.net.", "tags" => [ [0] "_grokparsefailure" ``` Any ideas? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 14, 2016, 11:46am UTC](https://discuss.elastic.co/t/grok-match-an-fqdn/47373/4 "2016-04-14T11:46:11Z")
Don't escape the angle brackets. I forgot that you have a period at the end of the input domain which I didn't take into account in my suggestion. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/grok-match-an-fqdn/47373/5 "2017-07-06T05:02:17Z")