I'm trying to figure out the best way to count total DNS Queries per hour or day. I can easily adjust period. But what would be the best way to count this?
Packetbeat is sending data to elasticsearch and i use kibana to visualize.
So far I've created a visualization like this:
Metrics Y-Axis Unique count of _id Buckets X-Axis @timestamp per hour
At first it did the trick and then started displaying errors like "10 of 21 shards failed" with " No results found".
I could also use:
Metrics Y-Axis Count Buckets X-Axis @timestamp per hour
That would display me the results but would that be correct way?
I tried counting the dns.id field but I've noticed that i have a lot of duplicate DNS ID's for different client_ip addresses so that is definitely not the correct way.
I could also count the client_ip's but that way i will not have a timestamp, instead it will just display top 5 IPs with number of hits.
So how am i to reach the most accurate data? Is my second example good enough?
I have a DNS that receives really large traffic, so i cannot manually count it to make sure