DNS lookup how to drop log filed if not resolved?

[iukea (jordan)]

Hello,

I am running logstash 6.8

I am taking all Src_Ip addresses and doing a reverse DNS lookup through the DNS plugin in logstash.

Logstash YML

  if [src_ip]  {
     
     
      mutate {
        add_field => {"DNS_Name" => "%{src_ip}"}
      }
      dns {
        reverse => ["DNS_Name"]
        action => "replace"
      }
  }

is there any way for if the IP address does not resolve back to a hostname for that field "DNS_Name" to be blank?

example dropping the field names DNS field name from 31.184.249.177 because it is not resolving to anything.

[Badger]

Compare the src_ip and DNS_Name fields and mutate the DNS_Name if it is equal to the src_ip?

[iukea (jordan)]

could you give me an example of that. i am getting my butt handed to me by logstash

[Badger]

The comparison would just be

if [src_ip] == [DNS_Name] {

If you want to delete the field then

mutate { remove_field => [ "DNS_Name" ] }

or if you want it to be an empty string

mutate { replace => { "DNS_Name" => "" } }

[iukea (jordan)]

mmmmm

changed the yml to

 if [src_ip] == [DNS_Name] { 
     
     
      mutate {
        add_field => {"DNS_Name" => "%{src_ip}"}
      }
      mutate { replace => { "DNS_Name" => "" } }
      
      dns {
        reverse => ["DNS_Name"]
        action => "replace"
      }

    }

I now I think i broke it
Now it is just blanking out the DNS Name even when it can be resolved.

[Badger]

dns {
    reverse => ["DNS_Name"]
    action => "replace"
}
if [src_ip] == [DNS_Name] {
    mutate { replace => { "DNS_Name" => "" } }
}

[iukea (jordan)]

You are a are a god!