# How to get the domain name from a fully qualified hostname via GROK

**URL:** https://discuss.elastic.co/t/how-to-get-the-domain-name-from-a-fully-qualified-hostname-via-grok/205429
**Category:** Logstash
**Created:** [October 28, 2019, 9:04am UTC](https://discuss.elastic.co/t/how-to-get-the-domain-name-from-a-fully-qualified-hostname-via-grok/205429 "2019-10-28T09:04:39Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)
#### Post date: [October 28, 2019, 2:18pm UTC](https://discuss.elastic.co/t/how-to-get-the-domain-name-from-a-fully-qualified-hostname-via-grok/205429/2 "2019-10-28T14:18:12Z")

</div>

Hello,

Thanks for reaching out. Just to clarify, are you using a logstash pipeline? If so would a grok pattern like the following work to break up the host name and domain name?

`%{DATA:host}\.%{GREEDYDATA:domain}`

Thanks.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-get-the-domain-name-from-a-fully-qualified-hostname-via-grok/205429)._