Hi, let's consider this simple example document: { "from": "user@mail.domain1.com", "to": "user2@mail.domain2.com" } I want to have aggregation based on domain's tld, l2 domain etc. In Elasticsearch 1.X I've wrote custom analyzers, that provide these tokens, but I cannot use them anymore …

Ingest - grok - more fields by same processor, domain parsing

system (system) Closed July 12, 2017, 11:37am 2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Elastic Ingest with multiple grok processors Elasticsearch	7	4759	January 31, 2017
Ingest Pipeline, set field derived from another Elasticsearch	3	310	March 23, 2021
Ingest pipline - multiple fields processed by one porcessor Elasticsearch	12	4091	March 31, 2019
Extract domain from field Logstash	4	840	November 2, 2018
Strip array off of ndjson data set using elasticsearch pipeline Elasticsearch ingest-pipeline	5	576	April 20, 2023