# Solved: removing domain name from hostname (host.name) with Logstash mutate split and replace filter

**URL:** <https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661>\
**Category:** Logstash\
**Created:** [August 19, 2020, 6:29pm UTC](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661 "2020-08-19T18:29:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Post date:** [August 19, 2020, 6:29pm UTC](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661/1 "2020-08-19T18:29:20Z")

</div>

I ran into an issue in Kibana where the logs for a server were not showing up after I clicked on a server in the Metrics -\> Inventory -\> Host logs. There were however logs in the Winlogbeat index that were specific to each server and within the timeframe that "Host logs" were pulling up. It seems like the filter in Host logs link was looking for just the host.name, ie abc1234, but the host.name of the servers was actually populating in our documents as, [abc1234.xyz.ny.gov](http://abc1234.xyz.ny.gov). I came across this thread, [How to parse a hostname](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038), and this was the solution, I just had to alter some of the pieces to fit this specific case. Hopefully, someone else finds this useful and it saves them some time.

Overall the host.name field that was populating in our documents as [abc1234.xyz.ny.gov](http://abc1234.xyz.ny.gov) was changed to abc1234 which allowed the Host logs link in the Metrics -\> Inventory UI to populate correctly.

```auto
filter {
  mutate {
    split => ["[host][name]", "."]
  }

  mutate {
    replace => ["[host][name]", "%{[host][name][0]}"]
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2020, 6:29pm UTC](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661/2 "2020-09-16T18:29:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.