# Replace Domain

**URL:** <https://discuss.elastic.co/t/replace-domain/42761>\
**Category:** Logstash\
**Created:** [February 25, 2016, 6:01pm UTC](https://discuss.elastic.co/t/replace-domain/42761 "2016-02-25T18:01:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_Andres\_Ramirez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_andres_ramirez/32/9467_2.png) [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\
**Post date:** [February 25, 2016, 6:01pm UTC](https://discuss.elastic.co/t/replace-domain/42761/1 "2016-02-25T18:01:18Z")

</div>

Hello Guys,  
In my config I have a filter to try replace domain1 by domain2, but I think it don't work.

I recieved for example the [server1.domain1.com](http://server1.domain1.com) and the same server with the domain2 and  
I don't want save the same server with 2 differents domain.

Please, anyone can check my filter?

Thank you.

`filter { mutate { add_field => { "hostname" => "%{host}" } gsub => ["hostname", "domain1","domain2"] } dns { action => "replace" reverse => ["hostname"] add_tag => ["dns_lookup"] } }`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 25, 2016, 7:26pm UTC](https://discuss.elastic.co/t/replace-domain/42761/2 "2016-02-25T19:26:43Z")

</div>

You shouldn't assume that the options to mutate are evaluated in the order they're listed. Try splitting the mutate filter in two; one with `add_field` and one with `gsub`.

---

<div class="post-metadata">

**Author:** ![Juan\_Andres\_Ramirez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_andres_ramirez/32/9467_2.png) [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\
**Post date:** [February 26, 2016, 12:26pm UTC](https://discuss.elastic.co/t/replace-domain/42761/3 "2016-02-26T12:26:33Z")

</div>

Hello Magnus,  
I tried again whith this code:

`mutate { add_field => { "hostname" => "%{host}" } } mutate { gsub => ["hostname", "domain1","domain2"] } dns { action => "replace" reverse => ["hostname"] add_tag => ["dns_lookup"] }`  
But nothing happend. Is available some way to check my filter with static values and will see if the domain is replaced?  
Or you have an other filter to replace the domain in hostname?.

Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 26, 2016, 2:28pm UTC](https://discuss.elastic.co/t/replace-domain/42761/4 "2016-02-26T14:28:34Z")

</div>

Please recognize the "nothing happened" is ambiguous. _What_ doesn't happen? The `hostname` field is never created? The domain name replacement doesn't happen? The DNS lookup doesn't take place? The mutate filters work just fine:

```nohighlight
$ cat test.config
input { stdin { codec => json } }
output { stdout { codec => rubydebug { metadata => true } } }
filter {
  mutate {
    add_field => { "hostname" => "%{host}" }
  }
  mutate {
    gsub => ["hostname", "domain1","domain2"]
  }
}
$ echo '{"host": "hostname.domain1.com"}' | /opt/logstash/bin/logstash -f test.config 
Settings: Default pipeline workers: 8
Logstash startup completed
{
          "host" => "hostname.domain1.com",
      "@version" => "1",
    "@timestamp" => "2016-02-26T14:24:24.925Z",
      "hostname" => "hostname.domain2.com"
}
Logstash shutdown completed

```

Is is really correct to list `hostname` in the `reverse` option? Reverse lookups for hostnames doesn't make sense.

---

<div class="post-metadata">

**Author:** ![Juan\_Andres\_Ramirez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_andres_ramirez/32/9467_2.png) [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\
**Post date:** [February 26, 2016, 2:56pm UTC](https://discuss.elastic.co/t/replace-domain/42761/5 "2016-02-26T14:56:04Z")

</div>

Sorry, the domain replacement doesn't happen.  
I'm going to try with your code.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/replace-domain/42761/6 "2017-07-06T05:09:35Z")

</div>