[HELP!]prepare logs for ML

[c00ld (Alex)]

Hello!
I have logs from dns, i need prepare it to Machine Learning in url
https://www.elastic.co/products/stack/machine-learning/recipes/dns-data-exfiltration-tunneling
Have a field: "my.support.base.net"
How to modify the field to "my.support.BASE.NET" and "MY.SUPPORT.base.net" in logstash filters or ruby ?

[Badger]

@c00ld

"my.support.base.net"

You can split that into domain and subdomain using

grok { match => { "myHost" => "%{GREEDYDATA:subdomain}\.(?<domain>[0-9A-Za-z][0-9A-Za-z-]{0,62}\.[0-9A-Za-z][0-9A-Za-z-]{0,62})$" } }

[c00ld (Alex)]

Thx a lot!