This is my filter:
filter {
if [type] == "netflow" {
mutate {
add_field => {
"[netflow][ipv4_dst_host]" => "%{[netflow][ipv4_dst_addr]}"
"[netflow][ipv4_src_host]" => "%{[netflow][ipv4_src_addr]}"
}
}
dns {
# DNS Filter
nameserver => [ "172.18.65.20", "172.18.65.30" ]
action => "replace"
reverse => [ "[netflow][ipv4_dst_host]", "[netflow][ipv4_src_host]" ]
}
}
}
Only [netflow][ipv4_dst_host] is filled with correct value.
Reverse lookups ipv4_src_host does never work.
Have I written some syntax wrong?