Split FQDN

[Dan_L (Dan)]

I'm trying to split an FQDN to get the base server name. Currently, the FQDN is stored in "server", so I'd like to split "server" on "." and get the name.
Additionally, sometimes the server may not be the FQDN, so it'd be useful if this would work regardless of whether the server field was an FQDN or not.

Has anyone had any experience doing this?

[kavierkoo (Kavier)]

There are plenty of solutions in the community posts.

With Split

How to parse a hostname

Magnus, Your recommendation worked, thanks for your prompt response. The following replaces my hostname from esx1.acme.com to esx1. mutate { split => ["syslog_hostname", "."] } mutate { replace => ["syslog_hostname", "%{[syslog_hostname][0]}"] } Thanks

With Grok

How to get the domain name from a fully qualified hostname via GROK

Hello, Thanks for reaching out. Just to clarify, are you using a logstash pipeline? If so would a grok pattern like the following work to break up the host name and domain name? %{DATA:host}\.%{GREEDYDATA:domain} Thanks.

Another Grok sample

Extracting Domain from URL

Untested: filter { grok { match => ["URL", "\.(?<Domain>[^.]+\.[^.]+)$"] } } Splitting the string on each period, grabbing the two last elements, and joining them back together should be a lot more efficient though.

[Dan_L (Dan)]

That first one worked for me, and while I haven't tested it yet I've wrapped it in an if else to check if there is a . in the "server" field before it bothers splitting it.