How to get the domain name from a fully qualified hostname via GROK

Elastic Stack Logstash
1

How to get the domain name from a fully qualified hostname via GROK.

I have used the pipeline to extract a couple of details from filebeat and getting one of the fields as hostname, needs to fetch the domain name from a fully qualified hostname.

Here are a couple of examples:

Fully qualified hostname could be:

host1.co.us
host2.ins.co.uk
host3.ar.uk.local

The domain name for the above hostname should be as follows:

co.us
ins.co.uk
ar.uk.local

Thanks for your help in advance.

2

Hello,

Thanks for reaching out. Just to clarify, are you using a logstash pipeline? If so would a grok pattern like the following work to break up the host name and domain name?

%{DATA:host}\.%{GREEDYDATA:domain}

Thanks.

3

Thanks a lot Michael. It works exactly what i need.

Have a great day !!

4

Hi,

I have tried the above pattern in GROK debugger and it is working fine however when adding as ELK via dev toll then getting error on tild slice before dot "%{DATA:host}\.%{GREEDYDATA:domain}" any suggestion could be really helpfull.

image

5

No worries, I have resolved the above issue !! Thanks for checking.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.