I noticed that a lot / all extracted urls are ending with a dot (xyz.com.)
That is of course not correct, so I want to remove that final dot.
The situation is as follows. I defined a couple of extractors which put data in a field named “url_or_whois”.
At the end of the extractor “que” I intend to place an extra extractor which should behave like this:
- run if field “url_or_whois” is populated and the content ends with a dot
- in that case the extractor should extract every thing before the dot at the end
- and place the result in “url_or_whois”
After this action the “url_or_whois” field should contain the same content, however without the dot at the string end
I hope this can be done which a combination of
- regex (to check if the field content ends on “.”)
- “regex or grok” to perform the action (I think the only option is one of those two)
I just do not know how 
I hope someone have a solution