# How to parse a hostname

**URL:** https://discuss.elastic.co/t/how-to-parse-a-hostname/33038
**Category:** Logstash
**Created:** [October 27, 2015, 3:11am UTC](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038 "2015-10-27T03:11:27Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Mark\_Tellier](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Mark\_Tellier](https://discuss.elastic.co/u/Mark_Tellier)
#### Post date: [October 27, 2015, 3:11am UTC](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038/1 "2015-10-27T03:11:27Z")

</div>

I am new to Logstash and am having difficulty with a filter, I would like to replace a fully qualified host name with the short host name.

The possible host name values are inconsistent:  
[esx1.acme.com](http://esx1.acme.com)  
[esx2.acme.com](http://esx2.acme.com)  
esx3  
[esx4.acme.com](http://esx4.acme.com)

I have tried variations of the following, the split filter works, creating an array ["esx4", "acme", "com"].  
I would like to replace the syslog\_hostname array with just the hostname and skip the filter if the string value doesn't contain the .acme.com domain name:

mutate {  
split =\> ["syslog\_hostname", "."]  
replace =\> ["syslog\_hostname", "%{[syslog\_hostname][0]}"]  
}

Any assistance would be much appreciated.

Thanks.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 27, 2015, 7:06am UTC](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038/2 "2015-10-27T07:06:08Z")

</div>

You must not count on the different options to the mutate filter to be run in the order specified because

```
mutate {
  a => b
  c => d
}

```

and

```
mutate {
  c => d
  a => b
}

```

are equivalent. In your case the `replace` option happens to be evaluated first, then the `split`. Split your mutate filter in two consecutive filters or use the gsub option.

---

<div class="post-metadata">

### Author: ![Mark\_Tellier](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Mark\_Tellier](https://discuss.elastic.co/u/Mark_Tellier)
#### Post date: [October 28, 2015, 1:33am UTC](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038/3 "2015-10-28T01:33:35Z")

</div>

Magnus,

Your recommendation worked, thanks for your prompt response.  
The following replaces my hostname from [esx1.acme.com](http://esx1.acme.com) to esx1.

```
mutate {
  split => ["syslog_hostname", "."]
}
mutate {
  replace => ["syslog_hostname", "%{[syslog_hostname][0]}"]
}

```

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038/4 "2017-07-06T05:25:09Z")

</div>