{Help me}Extracting Domain from Mail address

Elastic Stack Logstash
1

Hello Friends.

I need to extract the domain of an email address , I have a .csv , in one of the columns it stores the e -mail.
How can I do it only get the domain?

Note : This is my csv filter, it stores the e- mail address in the " orig" .

csv {

        columns => [ "type","timeLogged","timeQueued","orig","Domain","rcpt","orcpt","dsnAction","dsnStatus","dsnDiag","dsnMta","bounceCat","srcType","srcMta","dlvType","dlvSourceIp","dlvDestinationIp", "dlvEsmtpAvailable","dlvSize","vmta","jobId","envId","queue","vmtaPool" ]
        separator => ','
    }
2

What about https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html on the @?

3

What about Split filter plugin | Logstash Reference [8.11] | Elastic on the @?

I think you mean the mutate filter's split option rather than the split filter. Another option is using the grok filter.

4

Indeed I do.

5

this is my config

filter {
if [type] == "nginx_access" {
grok {
patterns_dir => "./patterns"
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
}
if [type] == "csv" {
csv {

        columns => [ "type","timeLogged","timeQueued","orig","rcpt","orcpt","dsnAction","dsnStatus","dsnDiag","dsnMta","bounceCat","srcType","srcMta","dlvType","dlvSourceIp","dlvDestinationIp", "dlvEsmtpAvailable","dlvSize","vmta","jobId","envId","queue","vmtaPool" ]
        separator => ','
              }
    mutate {
  add_field => { "orig" => "%{host}" }
   }

mutate {
add_field => { "Origem" => "%{orig}" }
}
mutate {
add_field => { "Origem" => "@%{orig}" }
}

}

6

In the column " orig " has the e- mail address , how can I get just the domain ?
My conf did not work.

7 
grok {
  match => {
    "orig" => "@%{GREEDYDATA:name-of-email-address-field}"
  }
}