# Filebeat causing high rate of invalid domain queries

**URL:** <https://discuss.elastic.co/t/filebeat-causing-high-rate-of-invalid-domain-queries/380883>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 7, 2025, 8:40pm UTC](https://discuss.elastic.co/t/filebeat-causing-high-rate-of-invalid-domain-queries/380883 "2025-08-07T20:40:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![zefferno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zefferno/32/144563_2.png) [@zefferno](https://discuss.elastic.co/u/zefferno)\
**Post date:** [August 7, 2025, 8:40pm UTC](https://discuss.elastic.co/t/filebeat-causing-high-rate-of-invalid-domain-queries/380883/1 "2025-08-07T20:40:05Z")

</div>

Hello all,

While investigating a problem with high DNS request rate on Core DNS, I started notice DNS requests from Filebeat to a domain with duplicated .svc in the name, e.g. eck-orchestration-app-elasticsearch-es-http.eck-operator.svc.eck-operator\*\*.svc.cluster.local\*\*. My Filebeat configuration does not contain this duplication:

```auto
filebeat:
    autodiscover:
        providers:
            - hints:
                default_config:
                    paths:
                        - /var/log/containers/*${data.kubernetes.container.id}.log
                    type: container
                enabled: true
              node: ${NODE_NAME}
              templates: null
              type: kubernetes
output:
    elasticsearch:
        hosts:
            - https://eck-orchestration-app-elasticsearch-es-http.eck-operator.svc:9200
        ssl:
            certificate_authorities:
                - /mnt/elastic-internal/elasticsearch-certs/ca.crt
        username: [REDUCTED]
setup:
    ilm:
        enabled: true
        policy_name: filebeat-logs
    template:
        settings:
            index:
                lifecycle:
                    name: filebeat-logs
                    rollover_alias: filebeat-logs-copy

```

I suspect something in the discovery, configuration or the Helm chart is appending **.svc.cluster.local** automatically, resulting in high number of invalid DNS queries.

Query to eck-orchestration-app-elasticsearch-es-http.eck-operator.svc does work if I try manually using curl.

Is there a discovery logic, or something else that could causing this duplication, and how can I prevent it?

Thanks!