Registered domain processor
The Registered domain processor extracts the domain, registered domain, top-level domain, and subdomain from a fully qualified domain name (FQDN).
To extract the parts of a domain:
- Select Create → Create processor.
- Select Registered domain from the Processor menu.
- Set the Field to the field containing the FQDN.
- Set Prefix to the prefix used for the output fields. The extracted parts are written as
<prefix>.domain,<prefix>.registered_domain,<prefix>.subdomain, and<prefix>.top_level_domain.
This functionality uses the Elasticsearch Registered domain processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.
In YAML mode, configure the registered domain processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.
| Parameter | Type | Required | Description |
|---|---|---|---|
expression |
string | Yes | Field containing the FQDN to parse. |
prefix |
string | Yes | Prefix for the output fields. The extracted parts are available as <prefix>.domain, <prefix>.registered_domain, <prefix>.subdomain, and <prefix>.top_level_domain. |
ignore_missing |
boolean | No | When true, skip this processor if the source field is missing. |
- action: registered_domain
expression: attributes.url.domain
prefix: attributes.domain
Given a document with attributes.url.domain set to www.example.com, the processor adds:
attributes.domain.domain: "www.example.com"attributes.domain.registered_domain: "example.com"attributes.domain.subdomain: "www"attributes.domain.top_level_domain: "com"