# Split FQDN
**URL:** https://discuss.elastic.co/t/split-fqdn/263773
**Category:** Logstash
**Created:** [February 9, 2021, 4:34pm UTC](https://discuss.elastic.co/t/split-fqdn/263773 "2021-02-09T16:34:37Z")
**Posts on this page:** 1
**Showing post:** 2
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [February 9, 2021, 4:43pm UTC](https://discuss.elastic.co/t/split-fqdn/263773/2 "2021-02-09T16:43:51Z")
There are plenty of solutions in the community posts.
With **Split**
> [@How to parse a hostname](https://discuss.elastic.co/t/how-to-parse-a-hostname/33038/3):
>
> Magnus, Your recommendation worked, thanks for your prompt response. The following replaces my hostname from [esx1.acme.com](http://esx1.acme.com) to esx1. mutate { split =\> ["syslog\_hostname", "."] } mutate { replace =\> ["syslog\_hostname", "%{[syslog\_hostname][0]}"] } Thanks
With **Grok**
> [@How to get the domain name from a fully qualified hostname via GROK](https://discuss.elastic.co/t/how-to-get-the-domain-name-from-a-fully-qualified-hostname-via-grok/205429/2):
>
> Hello, Thanks for reaching out. Just to clarify, are you using a logstash pipeline? If so would a grok pattern like the following work to break up the host name and domain name? %{DATA:host}\.%{GREEDYDATA:domain} Thanks.
Another **Grok** sample
> [@Extracting Domain from URL](https://discuss.elastic.co/t/extracting-domain-from-url/36219/3):
>
> Untested: filter { grok { match =\> ["URL", "\.(?\[^.]+\.[^.]+)$"] } } Splitting the string on each period, grabbing the two last elements, and joining them back together should be a lot more efficient though.
---
_[View the full topic](https://discuss.elastic.co/t/split-fqdn/263773)._