Make field reference after a certain value

[LeandroKopke]

I have a query that has two native fields, they are "referenced_host" and "url".
I performed the extraction of the "referenced_host" field by naming it as the domain.
The problem is that the domain field comes empty whenever the URL field contains "HTTPS" values.

Example:

"Referenced_host" field value = ctldl.windowsupdate.com
Domain field value = ctldl.windowsupdate.com
URL field value = http://ctldl.windowsupdate.com/msdownload/update/v3/stati (...)

Example 2:

Referenced_host field value = null
Domain field value = null
URL field value = https://www.facebook.com

Would I have to make the domain field assume the value of the URL field, every time the URL field has values ​​beginning with "HTTPS"?

[dmarling · Accepted solution]

The referenced host field extraction should be this so you get both http and https prefixed domains:

| rex field=URL "https?:\/\/(?<domain>[^\/\s]+)"

The "s?" in the regular expression means match 1 or 0 times so if a "s" is present it will still proceed to where the domain is located on your url.

Here's a link to this picking up both domain's you listed as examples in regex101: https://regex101.com/r/aFKeoc/1

[richgalloway]

How are you extracting the referenced_host field? You probably need to modify the extraction to recognize 'https'.

[LeandroKopke]

Extraction of the domain field was done based on the referenced_host field.
It turns out that every time the URL field comes with "HTTPS" the referenced_host field is empty, making the domain field also empty.
I need every time the URL field has values ​​with "HTTPS" the domain field assumes this value and every time the URL field comes with "HTTP" values ​​the domain field assumes the values ​​of the referenced_host field.