Dns Lookup save only when find hostname

Hello i'm trying to get hostname from the netflow i'm working on. From now on i have this code

 filter {

        # Don't save what concern the host
        #if "*.*.*.*" in ["%{[source][ip]}", "%{[dest][ip]}"] {
        #       drop {}
        #}

        cidr {
                add_field => ["direction", "incoming"]
                address => ["%{[dest][ip]}"]
                network => ["*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*"]
        }
        cidr {
                add_field => ["direction", "outgoing"]
                address => ["%{[source][ip]}"]
                network => ["*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*"]
        }
        cidr {
                add_field => ["network", "*.*.*.*/*"]
                address => ["%{[source][ip]}", "%{[dest][ip]}"]
                network => ["*.*.*.*/*"]
        }
        cidr {
                add_field => ["network", "*.*.*.*/*"]
                address => ["%{[source][ip]}", "%{[dest][ip]}"]
                network => ["*.*.*.*/*"]
        }
        cidr {
                add_field => ["network", "*.*.*.*/*"]
                address => ["%{[source][ip]}", "%{[dest][ip]}"]
                network => ["*.*.*.*/*"]

        }
        cidr {
                add_field => ["network", "*.*.*.*/*"]
                address => ["%{[source][ip]}", "%{[dest][ip]}"]
                network => ["*.*.*.*/*"]
        }

        if [direction] == "incoming" {
                mutate {
                        add_field => { "hostname" => "%{[source][ip]}"}
                }
                dns {
                        reverse => ["hostname"]
                        action => "replace"
                        nameserver => ["*.*.*.*"]
                }
                # Supprimer le field si pas de résolution dns pertinente
                if [hostname] == "%{[source][ip]}" {
                        mutate {
                                remove_field => ["hostname"]
                                add_tag => ["deletedDns"]
                    }
            }
    } else if [direction] == "outgoing" {
            mutate {
                    add_field => { "hostname" => "%{[dest][ip]}"}
            }
            dns {
                    reverse => ["hostname"]
                    action => "replace"
                    nameserver => ["*.*.*.*"]
            }
            # Supprimer le field si pas de résolution dns pertinente
            if [hostname] == "%{[source][ip]}" {
                    mutate {
                            remove_field => ["hostname"]
                            add_tag => ["deletedDns"]
                    }
            }
    }

}

So the problem is that when the 'hostname' field has acutally not changed it is not erased from the data.
I added a tag to see if the problem was from the condition or the 'remove_field' function but none of them are executed so i supposed the condition is the problem.

Thanks in advance for your help.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.