---
title: Registered domain processor
description: Extract the domain, registered domain, subdomain, and top-level domain from a fully qualified domain name with the Streams registered domain processor in Streamlang.
url: https://www.elastic.co/elastic/docs-builder/docs/3716/solutions/observability/streams/processors/registered-domain
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# Registered domain processor
The **Registered domain** processor extracts the domain, registered domain, top-level domain, and subdomain from a fully qualified domain name (FQDN).
To extract the parts of a domain:
1. Select **Create** → **Create processor**.
2. Select **Registered domain** from the **Processor** menu.
3. Set the **Field** to the field containing the FQDN.
4. Set **Prefix** to the prefix used for the output fields. The extracted parts are written as `<prefix>.domain`, `<prefix>.registered_domain`, `<prefix>.subdomain`, and `<prefix>.top_level_domain`.

This functionality uses the Elasticsearch [Registered domain processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3716/reference/ingest-processor/registered-domain-processor) internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to [Processor limitations and inconsistencies](/elastic/docs-builder/docs/3716/solutions/observability/streams/streamlang#streams-processor-inconsistencies).

## YAML reference

In [YAML mode](/elastic/docs-builder/docs/3716/solutions/observability/streams/parse-and-process#streams-editing-yaml-mode), configure the registered domain processor using the following parameters. For the complete Streamlang syntax, refer to the [Streamlang reference](https://www.elastic.co/elastic/docs-builder/docs/3716/solutions/observability/streams/streamlang).

| Parameter        | Type    | Required | Description                                                                                                                                                                |
|------------------|---------|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `expression`     | string  | Yes      | Field containing the FQDN to parse.                                                                                                                                        |
| `prefix`         | string  | Yes      | Prefix for the output fields. The extracted parts are available as `<prefix>.domain`, `<prefix>.registered_domain`, `<prefix>.subdomain`, and `<prefix>.top_level_domain`. |
| `ignore_missing` | boolean | No       | When `true`, skip this processor if the source field is missing.                                                                                                           |

```yaml
- action: registered_domain
  expression: attributes.url.domain
  prefix: attributes.domain
```

Given a document with `attributes.url.domain` set to `www.example.com`, the processor adds:
- `attributes.domain.domain: "www.example.com"`
- `attributes.domain.registered_domain: "example.com"`
- `attributes.domain.subdomain: "www"`
- `attributes.domain.top_level_domain: "com"`