Registered domain processor
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
9.5+
Generally available since 9.5
The Registered domain processor extracts the domain, registered domain, top-level domain, and subdomain from a fully qualified domain name (FQDN).
To extract the parts of a domain:
- Select Create → Create processor.
- Select Registered domain from the Processor menu.
- Set the Field to the field containing the FQDN.
- Set Prefix to the prefix used for the output fields. The extracted parts are written as
<prefix>.domain,<prefix>.registered_domain,<prefix>.subdomain, and<prefix>.top_level_domain.
This functionality uses the Elasticsearch Registered domain processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.
In YAML mode, configure the registered domain processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.
| Parameter | Type | Required | Description |
|---|---|---|---|
expression |
string | Yes | Field containing the FQDN to parse. |
prefix |
string | Yes | Prefix for the output fields. The extracted parts are available as <prefix>.domain, <prefix>.registered_domain, <prefix>.subdomain, and <prefix>.top_level_domain. |
ignore_missing |
boolean | No | When true, skip this processor if the source field is missing. |
- action: registered_domain
expression: attributes.url.domain
prefix: attributes.domain
Given a document with attributes.url.domain set to www.example.com, the processor adds:
attributes.domain.domain: "www.example.com"attributes.domain.registered_domain: "example.com"attributes.domain.subdomain: "www"attributes.domain.top_level_domain: "com"