# \[HELP!\]prepare logs for ML

**URL:** <https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232>\
**Category:** Logstash\
**Created:** [August 7, 2019, 11:56am UTC](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232 "2019-08-07T11:56:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![c00ld](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@c00ld](https://discuss.elastic.co/u/c00ld)\
**Post date:** [August 7, 2019, 11:56am UTC](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232/1 "2019-08-07T11:56:51Z")

</div>

Hello!  
I have logs from dns, i need prepare it to Machine Learning in url  
[https://www.elastic.co/products/stack/machine-learning/recipes/dns-data-exfiltration-tunneling](https://www.elastic.co/products/stack/machine-learning/recipes/dns-data-exfiltration-tunneling)  
Have a field: "[my.support.base.net](http://my.support.base.net)"  
How to modify the field to "[my.support.BASE.NET](http://my.support.BASE.NET)" and "[MY.SUPPORT.base.net](http://MY.SUPPORT.base.net)" in logstash filters or ruby ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 7, 2019, 12:06pm UTC](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232/2 "2019-08-07T12:06:33Z")

</div>

> [@c00ld](#):
>
> "[my.support.base.net](http://my.support.base.net)"

You can split that into domain and subdomain using

```
grok { match => { "myHost" => "%{GREEDYDATA:subdomain}\.(?<domain>[0-9A-Za-z][0-9A-Za-z-]{0,62}\.[0-9A-Za-z][0-9A-Za-z-]{0,62})$" } }

```

---

<div class="post-metadata">

**Author:** ![c00ld](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@c00ld](https://discuss.elastic.co/u/c00ld)\
**Post date:** [August 7, 2019, 1:31pm UTC](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232/3 "2019-08-07T13:31:13Z")

</div>

Thx a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 1:31pm UTC](https://discuss.elastic.co/t/help-prepare-logs-for-ml/194232/4 "2019-09-04T13:31:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.