# DNS Filter and Winlogbeat problem

**URL:** <https://discuss.elastic.co/t/dns-filter-and-winlogbeat-problem/145345>\
**Category:** Logstash\
**Created:** [August 21, 2018, 9:37am UTC](https://discuss.elastic.co/t/dns-filter-and-winlogbeat-problem/145345 "2018-08-21T09:37:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ronnykwon](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@ronnykwon](https://discuss.elastic.co/u/ronnykwon)\
**Post date:** [August 21, 2018, 9:37am UTC](https://discuss.elastic.co/t/dns-filter-and-winlogbeat-problem/145345/1 "2018-08-21T09:37:53Z")

</div>

I'm new to logstash and I've been using winlogbeat to get log event and I wanted to do a DNS lookup on the field Workstation  
While trying the dns filter I encounter a strange bug

my pipeline configuration is as followed :

```
input {
    stdin {
      codec => json
    }
}

filter {
    json {
      source => "message"
    }
    if [_source][type] == "wineventlog" {
        dns {
            reverse => ["[_source][event_data][Workstation]"]
            action => replace
            add_tag => ["dns_lookup"]
            add_field => { "[_source][event_data][ip_addr]" => "%{[_source][event_data[Workstation]}" }
        }
    }
}

output {
    stdout {
      codec => rubydebug
    }
}

```

in case the \_source[type] field is set to wineventlog I should have a tag added  
it works with the following json :

```
{"_source": {"type": "wineventlog", "event_data" : { "workstation" : "www.google.fr" } } }

```

output :

```
{
  "@version" => "1",
"@timestamp" => 2018-08-21T09:36:14.396Z,
      "host" => "localhost.localdomain",
      "tags" => [
    [0] "dns_lookup"
],
"event_data" => {
    "ip_addr" => "%{[_source][event_data[Workstation]}"
},
   "_source" => {
          "type" => "wineventlog",
    "event_data" => {
        "workstation" => "www.google.fr"
    }
}
}

```

but not with the one I'm supposed to handle (notice the case of Workstation field)

```
{"_source": {"type": "wineventlog", "event_data" : { "Workstation" : "www.google.fr" } } }

```

output :

```
{
  "@version" => "1",
"@timestamp" => 2018-08-21T09:50:00.006Z,
      "host" => "localhost.localdomain",
   "_source" => {
          "type" => "wineventlog",
    "event_data" => {
        "Workstation" => "www.google.fr"
    }
}
}

```

what am I doing wrong ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2018, 9:38am UTC](https://discuss.elastic.co/t/dns-filter-and-winlogbeat-problem/145345/2 "2018-09-18T09:38:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.