# Dns Lookup save only when find hostname

**URL:** <https://discuss.elastic.co/t/dns-lookup-save-only-when-find-hostname/111368>\
**Category:** Logstash\
**Created:** [December 12, 2017, 2:59pm UTC](https://discuss.elastic.co/t/dns-lookup-save-only-when-find-hostname/111368 "2017-12-12T14:59:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SchwiftyDoc](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@SchwiftyDoc](https://discuss.elastic.co/u/SchwiftyDoc)\
**Post date:** [December 12, 2017, 2:59pm UTC](https://discuss.elastic.co/t/dns-lookup-save-only-when-find-hostname/111368/1 "2017-12-12T14:59:12Z")

</div>

Hello i'm trying to get hostname from the netflow i'm working on. From now on i have this code

> ```
> filter {
> 
> # Don't save what concern the host
> #if "*.*.*.*" in ["%{[source][ip]}", "%{[dest][ip]}"] {
> # drop {}
> #}
> 
> cidr {
> add_field => ["direction", "incoming"]
> address => ["%{[dest][ip]}"]
> network => ["*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*"]
> }
> cidr {
> add_field => ["direction", "outgoing"]
> address => ["%{[source][ip]}"]
> network => ["*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*", "*.*.*.*/*"]
> }
> cidr {
> add_field => ["network", "*.*.*.*/*"]
> address => ["%{[source][ip]}", "%{[dest][ip]}"]
> network => ["*.*.*.*/*"]
> }
> cidr {
> add_field => ["network", "*.*.*.*/*"]
> address => ["%{[source][ip]}", "%{[dest][ip]}"]
> network => ["*.*.*.*/*"]
> }
> cidr {
> add_field => ["network", "*.*.*.*/*"]
> address => ["%{[source][ip]}", "%{[dest][ip]}"]
> network => ["*.*.*.*/*"]
> 
> }
> cidr {
> add_field => ["network", "*.*.*.*/*"]
> address => ["%{[source][ip]}", "%{[dest][ip]}"]
> network => ["*.*.*.*/*"]
> }
> 
> if [direction] == "incoming" {
> mutate {
> add_field => { "hostname" => "%{[source][ip]}"}
> }
> dns {
> reverse => ["hostname"]
> action => "replace"
> nameserver => ["*.*.*.*"]
> }
> # Supprimer le field si pas de résolution dns pertinente
> if [hostname] == "%{[source][ip]}" {
> mutate {
> remove_field => ["hostname"]
> add_tag => ["deletedDns"]
> }
> }
> } else if [direction] == "outgoing" {
> mutate {
> add_field => { "hostname" => "%{[dest][ip]}"}
> }
> dns {
> reverse => ["hostname"]
> action => "replace"
> nameserver => ["*.*.*.*"]
> }
> # Supprimer le field si pas de résolution dns pertinente
> if [hostname] == "%{[source][ip]}" {
> mutate {
> remove_field => ["hostname"]
> add_tag => ["deletedDns"]
> }
> }
> }
> 
> ```
> 
> }

So the problem is that when the 'hostname' field has acutally not changed it is not erased from the data.  
I added a tag to see if the problem was from the condition or the 'remove\_field' function but none of them are executed so i supposed the condition is the problem.

Thanks in advance for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2018, 2:59pm UTC](https://discuss.elastic.co/t/dns-lookup-save-only-when-find-hostname/111368/2 "2018-01-09T14:59:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.