re-added observer and log.source.hostname to host_split sans domain

Cargill · Sep 30, 2024 · 6250cd6 · 6250cd6
1 parent 59cd978
commit 6250cd6
Showing 1 changed file with 2 additions and 18 deletions.
diff --git a/config/enrichments/18_host_split.conf b/config/enrichments/18_host_split.conf
@@ -93,20 +93,12 @@ filter {
     if [log][source][hostname] =~ "^.*?\..*?$" {
       if [log][source][hostname] =~ "^\d+\.\d+\.\d+\.\d+\..*?$" {
         grok {
-          match => { "[log][source][hostname]" => "^(?<[log][source][tmp]>\d+.\d+.\d+.\d+)\.(?<[log][source][domain]>.*?)$" }
+          match => { "[log][source][hostname]" => "^(?<[log][source][tmp]>\d+.\d+.\d+.\d+)\..*?$" }
           tag_on_failure => "_logsourcehostname_grok_failure"
         }
         mutate {
           rename => { "[log][source][tmp]" => "[log][source][hostname]" }
         }
-      } else if [log][source][hostname] !~ "^\d+\.\d+\.\d+\.\d+$" {
-        grok {
-          match => { "[log][source][hostname]" => "^(?<[log][source][tmp]>.*?)\.(?<[log][source][domain]>.*?)$" }
-          tag_on_failure => "_logsourcehostname_grok_failure_2"
-        }
-        mutate {
-          rename => { "[log][source][tmp]" => "[log][source][hostname]" }
-        }
       }
     }
 
@@ -135,20 +127,12 @@ filter {
     if [observer][hostname] =~ "^.*?\..*?$" {
       if [observer][hostname] =~ "^\d+\.\d+\.\d+\.\d+\..*?$" {
         grok {
-          match => { "[observer][hostname]" => "^(?<[observer][tmp]>\d+.\d+.\d+.\d+)\.(?<[observer][domain]>.*?)$" }
+          match => { "[observer][hostname]" => "^(?<[observer][tmp]>\d+.\d+.\d+.\d+)\..*?$" }
           tag_on_failure => "_observerhostname_grok_failure"
         }
         mutate {
           rename => { "[observer][tmp]" => "[observer][hostname]" }
         }
-      } else if [observer][hostname] !~ "^\d+\.\d+\.\d+\.\d+$" {
-        grok {
-          match => { "[observer][hostname]" => "^(?<[observer][tmp]>.*?)\.(?<[observer][domain]>.*?)$" }
-          tag_on_failure => "_observerhostname_grok_failure_2"
-        }
-        mutate {
-          rename => { "[observer][tmp]" => "[observer][hostname]" }
-        }
       }
     }
   }