I have a query that has two native fields, they are "referenced_host" and "url".
I performed the extraction of the "referenced_host" field by naming it as the domain.
The problem is that the domain field comes empty whenever the URL field contains "HTTPS" values.
Example:
"Referenced_host" field value = ctldl.windowsupdate.com
Domain field value = ctldl.windowsupdate.com
URL field value = http://ctldl.windowsupdate.com/msdownload/update/v3/stati (...)
Example 2:
Referenced_host field value = null
Domain field value = null
URL field value = https://www.facebook.com
Would I have to make the domain field assume the value of the URL field, every time the URL field has values beginning with "HTTPS"?
The referenced host field extraction should be this so you get both http and https prefixed domains:
| rex field=URL "https?:\/\/(?<domain>[^\/\s]+)"
The "s?" in the regular expression means match 1 or 0 times so if a "s" is present it will still proceed to where the domain is located on your url.
Here's a link to this picking up both domain's you listed as examples in regex101: https://regex101.com/r/aFKeoc/1
The referenced host field extraction should be this so you get both http and https prefixed domains:
| rex field=URL "https?:\/\/(?<domain>[^\/\s]+)"
The "s?" in the regular expression means match 1 or 0 times so if a "s" is present it will still proceed to where the domain is located on your url.
Here's a link to this picking up both domain's you listed as examples in regex101: https://regex101.com/r/aFKeoc/1
How are you extracting the referenced_host field? You probably need to modify the extraction to recognize 'https'.
Extraction of the domain field was done based on the referenced_host field.
It turns out that every time the URL field comes with "HTTPS" the referenced_host field is empty, making the domain field also empty.
I need every time the URL field has values with "HTTPS" the domain field assumes this value and every time the URL field comes with "HTTP" values the domain field assumes the values of the referenced_host field.