diff --git a/dockerfiles/cherokee/cherokee.dockerfile b/dockerfiles/cherokee/cherokee.dockerfile
new file mode 100644
index 0000000..6c0c679
--- /dev/null
+++ b/dockerfiles/cherokee/cherokee.dockerfile
@@ -0,0 +1,10 @@
+FROM debian:stretch
+#FROM ubuntu:16.04
+
+MAINTAINER tabledevil
+
+
+RUN groupadd -g 999 user && \
+    useradd -r -u 999 -g user user
+
+USER user
diff --git a/dockerfiles/logstash/configs/bwi.conf b/dockerfiles/logstash/configs/bwi.conf
index 784953a..6d6d733 100644
--- a/dockerfiles/logstash/configs/bwi.conf
+++ b/dockerfiles/logstash/configs/bwi.conf
@@ -76,6 +76,10 @@ filter {
         #     source => "mwg[src]"
         #     target => "mwg[src_geo]"
         # }
+        #url aufteilen nach subdomain.domain.tld
+        grok {
+          match => { "mwg[url]" => "%{URIPROTO:mwg[urlparsed][proto]}://(?<mwg[urlparsed][subdom]>[^/]+)\.(?<mwg[urlparsed][domain]>[^/.]+)\.(?<mwg[urlparsed][tld]>[^/.]+)" }
+        }
 
 
           # mutate {
diff --git a/reset_screens.sh b/reset_screens.sh
index 3bb3fdd..a75d495 100755
--- a/reset_screens.sh
+++ b/reset_screens.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 xrandr --output DVI-I-1 --mode 1920x1080 --rotate left --pos 0x0
 xrandr --output DP-2 --primary --mode 2560x1440 --pos 1080x350
-xrandr --output DP-3 --mode 2560x1440 --pos 3640x350
+xrandr --output DP-1 --mode 2560x1440 --pos 3640x350
diff --git a/urldecode.py b/urldecode.py
new file mode 100755
index 0000000..92db484
--- /dev/null
+++ b/urldecode.py
@@ -0,0 +1,6 @@
+#!/usr/bin/python3
+from urllib.parse import unquote
+import html
+import sys
+url=' '.join(sys.argv[1:])
+print(html.unescape(unquote(url)))
diff --git a/youtube_resolve.sh b/youtube_resolve.sh
new file mode 100755
index 0000000..4036b0e
--- /dev/null
+++ b/youtube_resolve.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+url=$(echo -ne "${*}" | grep -Pio -m1 'https://www.youtube.com/watch\?[^&|]+')
+title=$(wget -q -O- "${url}" | grep -Po "(?<=title>).*(?=</title)")
+title_parsed=$(cat <<eof | python3
+from urllib.parse import unquote
+import html
+import sys
+url="${title}"
+print(html.unescape(unquote(url)))
+eof
+)
+
+echo "${*};\"${title_parsed}\""