DNS Lookup result in Discover Apache Logs

Elastic Stack Kibana
1

Hello.

Faced with the need to see in the Apache log report the host name by ip-address (dns lookup reverse). I use Elastic Cloud and do not fully understand how this can be done.

I added settings to filebeat.yml (on the server where the logs come from), indicated this:

processors:

  - dns:
      type: reverse
      fields:
        source.ip: source.hostname
        destination.ip: destination.hostname

  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

but the data did not appear in the report. Perhaps you need to somehow add a new field? I am new to this question. Perhaps someone knows why this does not work for me?

2

Hi and welcome to our community !

Could you provide some details? Which kind of report do you mean? Did you check the, that the data arrived in Elasticsearch and can be found e.g. in Kibana's Discover?

Thx & Best,
Matthias

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.