# Bind9 elastic agent integration **URL:** \ **Category:** Elastic Agent\ **Created:** [February 15, 2024, 9:16pm UTC](https://discuss.elastic.co/t/bind9-elastic-agent-integration/353412 "2024-02-15T21:16:30Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Brennen\_Rose](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brennen_rose/32/131805_2.png) [@Brennen\_Rose](https://discuss.elastic.co/u/Brennen_Rose)\ **Post date:** [February 15, 2024, 9:16pm UTC](https://discuss.elastic.co/t/bind9-elastic-agent-integration/353412/1 "2024-02-15T21:16:31Z")
Hi there - we have setup a custom log ingestion pipeline from our DNS server running Bind. We had have an existing fleet agent running on that server, so we opted to add a custom pipeline with a grok for Bind9 logs. I am wondering if anyone has found a good way to resolve the time format of Bind9 logs (DD-MMM-YYYY HH:MM:SS.MS) into iso 8601. Also looking for help adding the fields of the DNS into the ECS, some are obvious but others are not. Here is a copy of our current grok: %{GREEDYDATA:event.created}\s\*%{WORD:meta.type:query}[:]\s\*%{WORD:meta.log\_level}: client @0x%{DATA:client.object\_identifier}\s\*%{IP:client.ip}#%{DATA:client.port}\s\*(%{DATA:dns.question.name}): view %{WORD:query\_info.query\_view}: %{WORD:dns.type:query}: %{DATA:query\_info.query\_name} %{WORD:dns.answers.class} %{WORD:dns.question.type} %{DATA:query\_info.RD\_Flag} (%{IP:query\_info.responding\_server\_ip}) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 14, 2024, 9:16pm UTC](https://discuss.elastic.co/t/bind9-elastic-agent-integration/353412/2 "2024-03-14T21:16:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.