input {

    # This works
    generator {
	message => "www.google.com"
	count => 1
	type => "test1"
    }

    # This will fail
    generator {
	message => "google.co.ukf"
	count => 1
	type => "test1"
    }

    # Shows using the source option
    generator {
	message => "The domain is www.google.com"
	count => 1
	type => "test2"
    }

}

filter {
    if [type] == "test1" {
	tld {}
    } 
    if [type] == "test2" {
	grok {
	    match => [ "message", "The domain is %{HOST:domain}" ]
	}
	tld {
	    source => "domain"
	}
    }
}

output {
    stdout { codec => rubydebug }
}