I want to remove the FDQN portion, leaving only the hostname, like so:
I am able to do this with the following:
rex field=host "(?<hostname>\w+)\."
However, this only returns data for the host fields that contain a period (".") - any host fields that contain only the host name are not returned. Using the sample data from above, the following search:
index="myindex" | rex field=host "(?<hostname>\w+)\." | table hostname
returns the following results:
How can I strip the FQDN data from the host field only for the fields for which that is applicable?
An alternative approach is to run your original (or one from @renjith_nair ) regex, and then coalesce that value with "host". In that way, you can be sure of always getting one value in your final field, even if the regex fails because you have hosts with unusual names.
index="myindex" | rex field=host "(?<hostname>\w+)\." | eval hostname=coalesce(hostname, host)|table hostname