# Grok query domain from DNS server log
**URL:** https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770
**Category:** Logstash
**Created:** [July 12, 2017, 7:42am UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770 "2017-07-12T07:42:55Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [July 12, 2017, 7:42am UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770/1 "2017-07-12T07:42:55Z")
Hi,
I'm using Elastic Stack V5.5 and using logstahs for parse log from DNS server log. Something like that
```
(6)mobile(4)pipe(4)aria(9)microsoft(3)com(0)
(7)outlook(6)office(3)com(0)
(5)nexus(10)officeapps(4)live(3)com(0)
```
Now i want parse query domain to friendly domain like
```
mobile.pipe.aria.microsoft.com
outlook.office.com
nexus.officeapps.live.com
```
How can do it?
Thanks so much!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 12, 2017, 2:59pm UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770/2 "2017-07-12T14:59:58Z")
How about using a mutate filter and its gsub option to replace `\(\d+\)` with a period?
---
### Author:  [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [July 12, 2017, 3:25pm UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770/3 "2017-07-12T15:25:38Z")
Thank for your suggestion. It's worked, but i got string after used gsub
> .mobile.pipe.aria.microsoft.com.
How to remove first and last dot (.) in string ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 12, 2017, 3:33pm UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770/4 "2017-07-12T15:33:41Z")
> How to remove first and last dot (.) in string ?
Use gsub to replace `^\.` and `\.$` with empty strings.
---
### Author:  [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [July 12, 2017, 3:35pm UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770/5 "2017-07-12T15:35:09Z")
Thanks you so much!
My problem is solved!
Is config looklike that ?
```
filter {
mutate {
gsub => [
"domain", "\(\d+\)", ".",
"domain", "^\.", "",
"domain", "\.$", ""
]
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2017, 3:35pm UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770/6 "2017-08-09T15:35:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.