# DNS Sink hole logstash config file filter **URL:** \ **Category:** Logstash\ **Created:** [September 3, 2017, 2:25pm UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222 "2017-09-03T14:25:55Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [September 3, 2017, 2:25pm UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222/1 "2017-09-03T14:25:56Z")
Hi Guys, I have pfsense 2.3 and have configured DNS resolver or sinkhole on the same. In short I have zone files which when query is matched that request will be sinkholed. This procedure is absolutely fine now I need to collect those logs and present a nice dashboard but before that I need to build logstash config file. Can some one plss help me with logstash config file for below logs? I am completely clueless here. Here are the DNS resolver logs. Time Process PID Message Sep 3 19:41:58 named 33194 queries: info: client @0x803066200 192.168.5.103#62054 ([cisco.com](http://cisco.com)): view cleandns: query: [cisco.com](http://cisco.com) IN A +E(0)K (192.168.5.25) Sep 3 19:41:45 named 33194 queries: info: client @0x80306d000 192.168.5.103#62977 ([gmail.com](http://gmail.com)): view cleandns: query: [gmail.com](http://gmail.com) IN MX +E(0)K (192.168.5.25) Sep 3 19:21:17 named 33194 queries: info: client @0x80306d000 192.168.5.103#59761 ([zzzha.com](http://zzzha.com)): view cleandns: query: [zzzha.com](http://zzzha.com) IN A +E(0)K (192.168.5.25) Sep 3 19:19:17 named 33194 queries: info: client @0x80306d000 192.168.5.103#59564 ([zzztech.com](http://zzztech.com)): view cleandns: query: [zzztech.com](http://zzztech.com) IN AAAA + (192.168.5.25) Sep 3 19:19:17 named 33194 queries: info: client @0x80306d000 192.168.5.103#59563 ([zzztech.com](http://zzztech.com)): view cleandns: query: [zzztech.com](http://zzztech.com) IN A + (192.168.5.25) Sep 3 19:19:17 named 33194 queries: info: client @0x80306d000 192.168.5.103#59562 ([zzztech.com](http://zzztech.com)): view cleandns: query: [zzztech.com](http://zzztech.com) IN AAAA + (192.168.5.25) Sep 3 19:19:16 named 33194 queries: info: client @0x803066200 192.168.5.103#59561 ([zzztech.com](http://zzztech.com)): view cleandns: query: [zzztech.com](http://zzztech.com) IN A + (192.168.5.25) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 4, 2017, 5:35am UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222/2 "2017-09-04T05:35:19Z")
What's the expected result of parsing these logs? ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [September 4, 2017, 6:00am UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222/3 "2017-09-04T06:00:56Z")
Well, for time being I would like to collect domain names which are queried and then client who is querying that is IP address just before # like 192.168.5.103#59562 So I need to know here Domains TYpe i.e. A, MX, AAAA, Client IP In these logs [zzzha.com](http://zzzha.com) is a malicious domain queried by 192.168.5.103. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 4, 2017, 11:18am UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222/4 "2017-09-04T11:18:46Z")
Have you look into the grok filter? If you're not familiar with grok expressions (which are essentially regular expressions) you can use the grok constructor web site. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 2, 2017, 11:19am UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222/5 "2017-10-02T11:19:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.