Using rex to remove data from a field where only some of the events contain the data?

[nakiamatthews]

This was hard to describe in a title!

The host field for some indexed events includes the full FQDN, while on others only the hostname populates the host field. Examples:

host=server1.acme.com
host=server2
host=server3.local

I want to remove the FDQN portion, leaving only the hostname, like so:

host=server1
host=server2
host=server3

I am able to do this with the following:

rex field=host "(?<hostname>\w+)\."  

However, this only returns data for the host fields that contain a period (".") - any host fields that contain only the host name are not returned. Using the sample data from above, the following search:

index="myindex" |  rex field=host "(?<hostname>\w+)\." | table hostname

returns the following results:

server1
server3

How can I strip the FQDN data from the host field only for the fields for which that is applicable?

[nickhills]

An alternative approach is to run your original (or one from @renjith_nair ) regex, and then coalesce that value with "host".
In that way, you can be sure of always getting one value in your final field, even if the regex fails because you have hosts with unusual names.

index="myindex" | rex field=host "(?<hostname>\w+)\." | eval hostname=coalesce(hostname, host)|table hostname

[renjith_nair · Accepted solution]

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"

[nakiamatthews]

Thanks! The following option worked without having to combine any fields.

|rex field=host "(?<hostname>[^\.]+)"