# {Help me}Extracting Domain from Mail address

**URL:** <https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186>\
**Category:** Logstash\
**Created:** [September 9, 2016, 6:10pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186 "2016-09-09T18:10:18Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Uriel\_Ricardo](https://avatars.discourse-cdn.com/v4/letter/u/9f8e36/32.png) [@Uriel\_Ricardo](https://discuss.elastic.co/u/Uriel_Ricardo)\
**Post date:** [September 9, 2016, 6:10pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/1 "2016-09-09T18:10:18Z")

</div>

Hello Friends.

I need to extract the domain of an email address , I have a .csv , in one of the columns it stores the e -mail.  
How can I do it only get the domain?

Note : This is my csv filter, it stores the e- mail address in the " orig" .

csv {

```
        columns => ["type","timeLogged","timeQueued","orig","Domain","rcpt","orcpt","dsnAction","dsnStatus","dsnDiag","dsnMta","bounceCat","srcType","srcMta","dlvType","dlvSourceIp","dlvDestinationIp", "dlvEsmtpAvailable","dlvSize","vmta","jobId","envId","queue","vmtaPool"]
        separator => ','
    }
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 11, 2016, 10:57am UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/2 "2016-09-11T10:57:05Z")

</div>

What about [https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) on the `@`?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 11, 2016, 8:07pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/3 "2016-09-11T20:07:04Z")

</div>

> What about [Split filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) on the @?

I think you mean the mutate filter's split option rather than the split filter. Another option is using the grok filter.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 11, 2016, 9:26pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/4 "2016-09-11T21:26:38Z")

</div>

Indeed I do.

---

<div class="post-metadata">

**Author:** ![Uriel\_Ricardo](https://avatars.discourse-cdn.com/v4/letter/u/9f8e36/32.png) [@Uriel\_Ricardo](https://discuss.elastic.co/u/Uriel_Ricardo)\
**Post date:** [September 11, 2016, 11:22pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/5 "2016-09-11T23:22:53Z")

</div>

this is my config

filter {  
if [type] == "nginx\_access" {  
grok {  
patterns\_dir =\> "./patterns"  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}  
}  
}  
if [type] == "csv" {  
csv {

```
        columns => ["type","timeLogged","timeQueued","orig","rcpt","orcpt","dsnAction","dsnStatus","dsnDiag","dsnMta","bounceCat","srcType","srcMta","dlvType","dlvSourceIp","dlvDestinationIp", "dlvEsmtpAvailable","dlvSize","vmta","jobId","envId","queue","vmtaPool"]
        separator => ','
              }
    mutate {
  add_field => { "orig" => "%{host}" }
   }

```

mutate {  
add\_field =\> { "Origem" =\> "%{orig}" }  
}  
mutate {  
add\_field =\> { "Origem" =\> "@%{orig}" }  
}

}

---

<div class="post-metadata">

**Author:** ![Uriel\_Ricardo](https://avatars.discourse-cdn.com/v4/letter/u/9f8e36/32.png) [@Uriel\_Ricardo](https://discuss.elastic.co/u/Uriel_Ricardo)\
**Post date:** [September 11, 2016, 11:25pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/6 "2016-09-11T23:25:10Z")

</div>

In the column " orig " has the e- mail address , how can I get just the domain ?  
My conf did not work.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 13, 2016, 5:45pm UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/7 "2016-09-13T17:45:46Z")

</div>

```nohighlight
grok {
  match => {
    "orig" => "@%{GREEDYDATA:name-of-email-address-field}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/help-me-extracting-domain-from-mail-address/60186/8 "2017-07-06T04:38:42Z")

</div>