Filebeat processor for single line logs?

Elastic Stack Beats
7

Unfortunately, you cannot use the DNS processor like this with the Apache module. The fields source.ip and destination.ip are extracted from the log lines on Elasticsearch. Thus, when Filebeat tries to run the DNS processor, it cannot do anything, as those fields do not exist at that point of processing.

DNS processor can only work if you add the fields to the event beforehand.

processors:
- add_fields:
  source.ip: 1.2.3.4
- dns:
  your_dns_config