im working with an elk stack that I did not deploy. I have an "index" for dns logs. it gives me a few default fields. The message field is given, but I noticed that the "client" and "query" with in it are things I would like to get a separate field for because they contain pertinent info. how would I add this ?
what file would I edit to not he Logstash server to add those two "fields" /etc/logstash/conf.d/* ?
the client field has the # sign added to it can I separate that ?
Im an elk noob sorry
message:<30>Feb 11 09:48:11 x.x.x.x named: client x.x.x.x#56007 (z03resources.renlearnrp.com): query: z03resources.renlearnrp.com IN A +ED (x.x.x.x)