# Dns log parsing and display in Kibana
**URL:** https://discuss.elastic.co/t/dns-log-parsing-and-display-in-kibana/242989
**Category:** Beats
**Tags:** packetbeat
**Created:** [July 29, 2020, 3:04am UTC](https://discuss.elastic.co/t/dns-log-parsing-and-display-in-kibana/242989 "2020-07-29T03:04:51Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@rossw](https://discuss.elastic.co/u/rossw)
#### Post date: [July 29, 2020, 3:04am UTC](https://discuss.elastic.co/t/dns-log-parsing-and-display-in-kibana/242989/1 "2020-07-29T03:04:51Z")
I think there is an error in the way that Packetbeat (7.8) parses DNS logs, and/or the way that Kibana displays them.
If I have a host 1.1.1.1 that sends a dns request for [microsoft.com](http://microsoft.com) to the DNS server 2.2.2.2, and packetbeat is running on 3.3.3.3 (hostname Sensor) with a span port that sees the DNS request.
When packetbeat parses the DNS packet, it populates the host.name ECS field with the name of the machine that is running the packetbeat instance. When this gets displayed by Kibana, the display processor uses the field host.name to populate the display such that it reads:
**Sensor asked for [microsoft.com](http://microsoft.com) with question type A** blah blah blah and further on it displays source and destination, and these are correctly shown as 1.1.1.1 and 2.2.2.2 respectively.
What I would have expected is:
**1.1.1.1 asked for [microsoft.com](http://microsoft.com) with question type A**
Is this an issue with Packetbeat not filling in the host.name field correctly, or Kibana not visualising the request properly.
Ross
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 29, 2020, 11:20am UTC](https://discuss.elastic.co/t/dns-log-parsing-and-display-in-kibana/242989/2 "2020-07-29T11:20:52Z")
Packetbeat always populates `host.name` with the name of the host it's running on. You can update your configuration drop this field. You can apply the config from this change [https://github.com/elastic/beats/pull/20309](https://github.com/elastic/beats/pull/20309).
```auto
tags: [forwarded]
processors:
- # Add forwarded to tags when processing data from a network tap or mirror.
if.contains.tags: forwarded
then:
- drop_fields:
fields: [host]
else:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
```
---
### Author:  [@rossw](https://discuss.elastic.co/u/rossw)
#### Post date: [July 29, 2020, 9:00pm UTC](https://discuss.elastic.co/t/dns-log-parsing-and-display-in-kibana/242989/3 "2020-07-29T21:00:55Z")
Perfect, thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2020, 11:00pm UTC](https://discuss.elastic.co/t/dns-log-parsing-and-display-in-kibana/242989/4 "2020-08-26T23:00:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.