ES|QL REGISTERED_DOMAIN command
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Preview
Preview
Stack
Preview
9.4+
Preview since 9.4
The REGISTERED_DOMAIN processing command parses a fully qualified domain name (FQDN) string and extracts its parts (domain, registered domain, top-level domain, subdomain) into new columns using the public suffix list.
This command doesn't support multi-value inputs.
REGISTERED_DOMAIN prefix = expression
prefix- The prefix for the output columns. The extracted parts are available as
prefix.part_name. expression- The string expression containing the FQDN to parse.
The REGISTERED_DOMAIN command parses an FQDN string and extracts its parts into new columns.
The new columns are prefixed with the specified prefix followed by a dot (.).
The following columns are created:
prefix.domain- The full domain name (the input FQDN).
prefix.registered_domain- The registered domain (e.g.
example.co.ukforwww.example.co.uk). prefix.top_level_domain- The effective top-level domain (eTLD), e.g.
co.uk,com. prefix.subdomain- The subdomain part, if any (e.g.
wwwforwww.example.co.uk).
If a part is missing or the input is not a valid FQDN, the corresponding column contains null.
If the expression evaluates to null or blank, all output columns are null.
The following example parses an FQDN and extracts its parts:
ROW fqdn = "www.example.co.uk"
| REGISTERED_DOMAIN rd = fqdn
| KEEP rd.*
| rd.domain:keyword | rd.registered_domain:keyword | rd.top_level_domain:keyword | rd.subdomain:keyword |
|---|---|---|---|
| www.example.co.uk | example.co.uk | co.uk | www |
You can use the extracted parts in subsequent commands, for example to filter by registered domain:
FROM web_logs
| REGISTERED_DOMAIN rd = domain
| WHERE rd.registered_domain == "elastic.co"
| STATS COUNT(*) BY rd.subdomain