Hay Rcowart
thank for this i just tried and with no luck i changed your filter you gave me to this
filter {
mutate {
add_field => { "hostname" => "%{host}"}
}
dns {
reverse => [ "hostname" ]
action => "replace"
# CUSTOMIZE THE FOLLOWING VALUES AS REQUIRED BY YOUR ENVIRONMENT!
nameserver => [ "XX.X.X.X" ]
hit_cache_size => 4096
hit_cache_ttl => 900
failed_cache_size => 512
failed_cache_ttl => 900
}
}
Can you see an issue with this config?
i also have and extra filter in the config, to just adds an new field what works