# Ingest - grok - more fields by same processor, domain parsing

**URL:** <https://discuss.elastic.co/t/ingest-grok-more-fields-by-same-processor-domain-parsing/89368>\
**Category:** Elasticsearch\
**Created:** [June 14, 2017, 11:37am UTC](https://discuss.elastic.co/t/ingest-grok-more-fields-by-same-processor-domain-parsing/89368 "2017-06-14T11:37:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jarda-manana](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jarda-manana](https://discuss.elastic.co/u/jarda-manana)\
**Post date:** [June 14, 2017, 11:37am UTC](https://discuss.elastic.co/t/ingest-grok-more-fields-by-same-processor-domain-parsing/89368/1 "2017-06-14T11:37:14Z")

</div>

Hi,  
let's consider this simple example document:

```
{
    "from": "user@mail.domain1.com",
    "to": "user2@mail.domain2.com"
}

```

I want to have aggregation based on domain's tld, l2 domain etc. In Elasticsearch 1.X I've wrote custom analyzers, that provide these tokens, but I cannot use them anymore because of keyword type (I cannot use the patter\_capture filter in a custom normalizer).

So I'm trying ingest node with grok processor in pipeline:

```
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "parse multiple patterns",
    "processors": [
      {
        "grok": {
          "field": "from",
          "patterns": [
            "%{EMAILADDRESS}"
          ],
          "pattern_definitions": {
            "DOM": "[0-9A-Za-z][0-9A-Za-z-]{0,62}",
            "BASEDOM": "(?<l2domain>%{DOM}\\.(?<tld>%{DOM}))",
            "FULLDOM": "((?:%{DOM}\\.)*%{BASEDOM})",
            "URL": "%{PROTOCOL}://%{FULLDOM}",
            "EMAILADDRESS": "%{EMAILLOCALPART:username}@%{FULLDOM:domain}"
          }
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "from": "user@mail.domain1.com"
      }
    }
  ]
}

```

Works fine, but now I need the exactly same processor, but on the "to" folder. Should I just copy&paste the same processor for rcpt field? Is there any way in how to change the destination fields in pattern definition according to processed field (I want something like {{ \_ingest.processed\_field }}\_tld ), or should I rename produced field names in way like: tld -\> from\_tld (in 1st processor) and to\_tld (in 2nd processor). It will work, but it seems to be little bit clumsy.

Thanks for suggestions!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2017, 11:37am UTC](https://discuss.elastic.co/t/ingest-grok-more-fields-by-same-processor-domain-parsing/89368/2 "2017-07-12T11:37:31Z")

</div>

Closed on July 12, 2017, 11:37am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.