# Split FQDN
**URL:** https://discuss.elastic.co/t/split-fqdn/263773
**Category:** Logstash
**Created:** [February 9, 2021, 4:34pm UTC](https://discuss.elastic.co/t/split-fqdn/263773 "2021-02-09T16:34:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Dan\_L](https://discuss.elastic.co/u/Dan_L)
#### Post date: [February 9, 2021, 4:34pm UTC](https://discuss.elastic.co/t/split-fqdn/263773/1 "2021-02-09T16:34:37Z")
I'm trying to split an FQDN to get the base server name. Currently, the FQDN is stored in "server", so I'd like to split "server" on "." and get the name.
Additionally, sometimes the server may not be the FQDN, so it'd be useful if this would work regardless of whether the server field was an FQDN or not.
Has anyone had any experience doing this?
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [February 9, 2021, 4:43pm UTC](https://discuss.elastic.co/t/split-fqdn/263773/2 "2021-02-09T16:43:51Z")
There are plenty of solutions in the community posts.
With **Split**
> [@How to parse a hostname](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038/3):
>
> Magnus, Your recommendation worked, thanks for your prompt response. The following replaces my hostname from [esx1.acme.com](http://esx1.acme.com) to esx1. mutate { split =\> ["syslog\_hostname", "."] } mutate { replace =\> ["syslog\_hostname", "%{[syslog\_hostname][0]}"] } Thanks
With **Grok**
> [@How to get the domain name from a fully qualified hostname via GROK](https://discuss.elastic.co/t/how-to-get-the-domain-name-from-a-fully-qualified-hostname-via-grok/205429/2):
>
> Hello, Thanks for reaching out. Just to clarify, are you using a logstash pipeline? If so would a grok pattern like the following work to break up the host name and domain name? %{DATA:host}\.%{GREEDYDATA:domain} Thanks.
Another **Grok** sample
> [@Extracting Domain from URL](https://discuss.elastic.co/t/extracting-domain-from-url/36219/3):
>
> Untested: filter { grok { match =\> ["URL", "\.(?\[^.]+\.[^.]+)$"] } } Splitting the string on each period, grabbing the two last elements, and joining them back together should be a lot more efficient though.
---
### Author:  [@Dan\_L](https://discuss.elastic.co/u/Dan_L)
#### Post date: [February 9, 2021, 4:54pm UTC](https://discuss.elastic.co/t/split-fqdn/263773/3 "2021-02-09T16:54:53Z")
That first one worked for me, and while I haven't tested it yet I've wrapped it in an if else to check if there is a . in the "server" field before it bothers splitting it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2021, 4:55pm UTC](https://discuss.elastic.co/t/split-fqdn/263773/4 "2021-03-09T16:55:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.