Fix on cisco.url fields

Cisco/cisco-esa/_meta/fields.yml

@@ -121,6 +121,11 @@ cisco.esa.url:
   name: cisco.esa.url
   type: keyword
 
+cisco.esa.url_domain:
+  description: ''
+  name: cisco.esa.url_domain
+  type: keyword
+
 email.attachments:
   description: A list of objects describing the attachment files sent along with an
     email message

Cisco/cisco-esa/ingest/parser.yml

@@ -209,9 +209,14 @@ stages:
                 {% endif %}
               {% endif %}
             {%- endfor %}]
+          cisco.esa.url_domain: >-
+            [{% for url, details in json_event_url_details.message.items() %}
+              {% if details.get('ExpandedUrl') is not none %}"{{url.split('/')[2]}}", "{{ details.ExpandedUrl.split('/')[2] }}"{% else %}"{{ url.split('/')[2] }}"{% endif %}
+              {% if not loop.last %},{% endif %}
+            {% endfor %}]
           cisco.esa.url: >-
-            [{% for url, details in dict(json_event_url_details.message).items() %}
-              "{% if details.get('ExpandedUrl') is not none %}{{ details.ExpandedUrl }}{% else %}{{ url }}{% endif %}"
+            [{% for url, details in json_event_url_details.message.items() %}
+              {% if details.get('ExpandedUrl') is not none %}"{{url}}", "{{ details.ExpandedUrl }}"{% else %}"{{ url }}"{% endif %}
               {% if not loop.last %},{% endif %}
             {% endfor %}]
           url.domain: "{{parsed_event.message.EAURLDetails}}"

Cisco/cisco-esa/tests/test_attachments_details.json

@@ -58,6 +58,10 @@
         "url": [
           "http://schemas.microsoft.com/office/2004/12/omml",
           "http://www.w3.org/TR/REC-html40"
+        ],
+        "url_domain": [
+          "schemas.microsoft.com",
+          "www.w3.org"
         ]
       }
     },

Cisco/cisco-esa/tests/test_ingest_log2.json

@@ -61,6 +61,10 @@
         "url": [
           "http://mandrill.appc.cisco.com/track/open.php?u=30372747&id=d57275a6c9df40418a90fd977e3bf506",
           "https://bce-demo.appc.cisco.com/sensors/a7b04388-0f6e-11e9-8def-0242ac110002"
+        ],
+        "url_domain": [
+          "bce-demo.appc.cisco.com",
+          "mandrill.appc.cisco.com"
         ]
       }
     },

Cisco/cisco-esa/tests/test_ingest_log5.json

@@ -55,7 +55,14 @@
         "url": [
           "https://facebook.com/u/john.doe",
           "https://tiktok.com",
+          "https://tinyurl.es/tbdra",
           "www.twitter.com"
+        ],
+        "url_domain": [
+          "",
+          "facebook.com",
+          "tiktok.com",
+          "tinyurl.es"
         ]
       }
     },

Cisco/cisco-esa/tests/test_ingest_log7.json

@@ -55,7 +55,8 @@
             "age": "30 days (or greater)"
           }
         },
-        "url": []
+        "url": [],
+        "url_domain": []
       }
     },
     "email": {