finally managed to figure this out
input {
file {
path => "/var/log/bind9/query.log"
start_position => beginning
}
}
filter {
grok {
match => {"message" => "client %{IP:clientip}#%{POSINT:clientport} (%{GREEDYDATA:query}): query: %{GREEDYDATA:Target} IN %{GREEDYDATA:querytype} (%{IP:dns})"}
}
}
output {
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
}
}
this is my conf file for extracting the DNS names of DNS queries into Kibana, it works, so now im mining data 