# BIND dns with Beats
**URL:** https://discuss.elastic.co/t/bind-dns-with-beats/247651
**Category:** Beats
**Tags:** filebeat, packetbeat
**Created:** [September 6, 2020, 4:06am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651 "2020-09-06T04:06:24Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)
#### Post date: [September 6, 2020, 4:06am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/1 "2020-09-06T04:06:25Z")
Hi,
I want to use elastic siem for my DNS server logs,
we are using a BIND DNS server, I don't want to install Packetbeat/Filebeat on the DNS server machine. we use syslog-ng to redirect DNS server logs to UDP port 514.
This is how my logs look like: (I get these result using nc -luv 514)
```auto
<13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.181 resolver: debug 1: createfetch: telemetry.dropbox.com A
<13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.283 database: debug 1: decrement_reference: delete from rbt: 0x7f38645f44e0 g.live.com
<13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.294 resolver: debug 1: createfetch: telemetry.v.dropbox.com A
<13>Sep 6 08:17:33 ns BIND-DNS: 08:17:35.173 queries: info: client 192.168.30.114#51723 (www.google.com): query: www.google.com IN A + (192.168.100.35)
```
I'm really confused and I don't have any idea what should I use, packetbeat (dns module)? filebeat dns/udp/syslog? I have tried with packetbeat and filebeat but I can't get it to work 😢
can someone please point me in the right direction?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 6, 2020, 11:50pm UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/2 "2020-09-06T23:50:05Z")
> [@Gomeisa](#):
>
> we use syslog-ng to redirect DNS server logs to UDP port 514.
And where do they go from there?
---
### Author:  [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)
#### Post date: [September 8, 2020, 4:25am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/3 "2020-09-08T04:25:08Z")
syslog-ng redirect logs to my elasticsearch server.
the sample logs were received on the elastic server.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 8, 2020, 4:27am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/4 "2020-09-08T04:27:13Z")
It goes directly to Elasticsearch from syslog-ng?
What do Beats have to do with things then?
---
### Author:  [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)
#### Post date: [September 8, 2020, 4:45am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/5 "2020-09-08T04:45:35Z")
Sorry, I think I explained badly, I meant it goes to the host that running my Elasticsearch. if I listen on port 514 I can see the logs, But now I need beats to send them to elasticsearch.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 8, 2020, 4:50am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/6 "2020-09-08T04:50:11Z")
Ok, did you look at [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html)?
---
### Author:  [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)
#### Post date: [September 8, 2020, 4:59am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/7 "2020-09-08T04:59:51Z")
Yes, I have tested syslog with UDP 514 but it didn't work.
It seems like it couldn't parse the data, or my data wasn't the expected format.
I know I can use processor for parsing, but I was looking for some preconfigured module that can detect DNS data (maybe like packetbeat dns config)
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 8, 2020, 5:09am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/8 "2020-09-08T05:09:25Z")
Ah ok, that's a bit clearer now 🙂
There's not at the moment, but it shouldn't be too hard to parse with an ingest pipeline. Can you share part of the raw log?
---
### Author:  [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)
#### Post date: [September 8, 2020, 5:14am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/9 "2020-09-08T05:14:01Z")
Thanks for being so patient 🙂
> [@Gomeisa](#):
>
> ```auto
> <13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.181 resolver: debug 1: createfetch: telemetry.dropbox.com A
> <13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.283 database: debug 1: decrement_reference: delete from rbt: 0x7f38645f44e0 g.live.com
> <13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.294 resolver: debug 1: createfetch: telemetry.v.dropbox.com A
> <13>Sep 6 08:17:33 ns BIND-DNS: 08:17:35.173 queries: info: client 192.168.30.114#51723 (www.google.com): query: www.google.com IN A + (192.168.100.35)
>
> ```
this is how my raw logs look like.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 8, 2020, 5:20am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/10 "2020-09-08T05:20:45Z")
No worries, I forgot you posted that originally! 🙂
I'll check out a possible pattern and circle back around on this/
---
### Author:  [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)
#### Post date: [September 8, 2020, 5:22am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/11 "2020-09-08T05:22:44Z")
Thank you, I greatly appreciate it 🙏
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 17, 2020, 12:22am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/12 "2020-09-17T00:22:44Z")
I ran into [a bug](https://github.com/elastic/kibana/issues/77006) with this, which held things up.
`<%{NUMBER:number}> %{MONTH:month} %{MONTHDAY:monthday} %{TIME:time} %{WORD:word} %{WORD:word2}-%{WORD:word3}: %{GREEDYDATA:data}` is a pattern that works with what you have provided.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2020, 2:22am UTC](https://discuss.elastic.co/t/bind-dns-with-beats/247651/13 "2020-10-15T02:22:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.