Registered Domain

Enrich Elastic Compatible

Synopsis

Extracts domain components from URLs or Fully Qualified Domain Names (FQDNs) using the Mozilla Public Suffix List to accurately identify the registered domain (eTLD), subdomain, and top-level domain parts.

Schema

- registered_domain:
    field: <ident>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing the URL or domain name
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, continue silently if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
target_field	N	-	Field to store extracted components. If omitted, components are added to root

Details

The processor can handle both full URLs and plain domain names, automatically parsing and extracting the following components:

• full domain name
• registered domain (effective TLD + one level)
• top-level domain
• subdomain (if present)

warning

Large numbers of domains may impact performance. Consider batching or limiting concurrent processing in such cases.

Examples

Basic

Parsing a simple domain name...	{ "domain": "www.example.com" } - registered_domain: field: domain target_field: url_parts
extracts all components:	{ "domain": "www.example.com", "url_parts": { "domain": "www.example.com", "registered_domain": "example.com", "top_level_domain": "com", "subdomain": "www" } }

URLs

Extract domains from full URLs...	{ "url": "https://blog.example.co.uk/path?param=value" } - registered_domain: field: url
handling complex TLDs:	{ "url": "https://blog.example.co.uk/path?param=value", "domain": "blog.example.co.uk", "registered_domain": "example.co.uk", "top_level_domain": "co.uk", "subdomain": "blog" }

Multi-Level

Process domains with multiple subdomains...	{ "host": "dev.api.company.com" } - registered_domain: field: host target_field: domain_info
preserving full subdomain structure:	{ "host": "dev.api.company.com", "domain_info": { "domain": "dev.api.company.com", "registered_domain": "company.com", "top_level_domain": "com", "subdomain": "dev.api" } }

Error Handling

Handle invalid domains gracefully...	{ "url": "http://invalid-url^%.com" } - registered_domain: field: url ignore_failure: true on_failure: - append: field: tags value: invalid_domain
with appropriate error handling:	{ "url": "http://invalid-url^%.com", "tags": ["invalid_domain"] }