How to get the domain name from a fully qualified hostname via GROK

Elastic Stack Logstash
2

Hello,

Thanks for reaching out. Just to clarify, are you using a logstash pipeline? If so would a grok pattern like the following work to break up the host name and domain name?

%{DATA:host}\.%{GREEDYDATA:domain}

Thanks.