- Heartbeat Reference: other versions:
- Overview
- Get started
- Set up and run
- Configure
- Monitors
- General settings
- Project paths
- Output
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Processors
- Define processors
- add_cloud_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_json_fields
- decompress_gzip_field
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- registered_domain
- rename
- truncate_fields
- Autodiscover
- Internal queue
- Logging
- HTTP endpoint
- Regular expression support
- heartbeat.reference.yml
- How to guides
- Exported fields
- Beat fields
- Cloud provider metadata fields
- Common heartbeat monitor fields
- Docker fields
- ECS fields
- Host fields
- HTTP monitor fields
- ICMP fields
- Jolokia Discovery autodiscover provider fields
- Kubernetes fields
- Process fields
- Host lookup fields
- SOCKS5 proxy fields
- Monitor summary fields
- TCP layer fields
- TLS encryption layer fields
- Monitor
- Secure
- Troubleshoot
- Contribute to Beats
Registered Domain
editRegistered Domain
editThe registered_domain
processor reads a field containing a hostname and then
writes the "registered domain" contained in the hostname to the target field.
For example, given www.google.co.uk
the processor would output google.co.uk
.
In other words the "registered domain" is the effective top-level domain
(co.uk
) plus one level (google
).
This processor uses the Mozilla Public Suffix list to determine the value.
processors: - registered_domain: field: dns.question.name target_field: dns.question.registered_domain ignore_missing: true ignore_failure: true
The registered_domain
processor has the following configuration settings:
Table 1. Registered Domain options
Name | Required | Default | Description | |
---|---|---|---|---|
|
yes |
Source field containing a fully qualified domain name (FQDN). |
||
|
yes |
Target field for the registered domain value. |
||
|
no |
false |
Ignore errors when the source field is missing. |
|
|
no |
false |
Ignore all errors produced by the processor. |
|
|
no |
An identifier for this processor instance. Useful for debugging. |