Merge pull request #535 from Cargill/url-enrichment-config

regex update to match - in domain
Cargill · Sep 12, 2024 · 84463cf · 84463cf
2 parents 5434739 + 5ecb139
commit 84463cf
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/enrichments/06_url.conf b/config/enrichments/06_url.conf
@@ -31,7 +31,7 @@ filter {
           lowercase => [ "[url][full]" ]
         }
         grok {
-          match => {"[url][full]" => "^((?<[tmp][url][scheme]>.*?)://)?((?<[tmp][user][name]>.*?):(?<[tmp][user][password]>.*?)@)?(?<[tmp][url][domain]>\w+((\.\w+){1,})|\d+\.\d+\.\d+\.\d+)(:(?<[tmp][url][port]>\d+))?(/|$)((?<[tmp][url][path]>.*?))?(\?(?<[tmp][url][query]>.*?))?(\#(?<[tmp][url][fragment]>.*?))?$" }
+          match => {"[url][full]" => "^((?<[tmp][url][scheme]>.*?)://)?((?<[tmp][user][name]>.*?):(?<[tmp][user][password]>.*?)@)?(?<[tmp][url][domain]>[\w\-\_\.]+)(:(?<[tmp][url][port]>\d+))?(/|$)((?<[tmp][url][path]>.*?))?(\?(?<[tmp][url][query]>.*?))?(\#(?<[tmp][url][fragment]>.*?))?$" }
           timeout_millis => 500
           tag_on_failure => "_groktimeout_url_en_1"
         }