Filebeat processrs revers dns only for private network

Elastic Stack Beats
1

I'm using filbeate to resolve reverse DNS lookup

  - dns:
      type: reverse
      fields:
        source.ip: source.hostname
        destination.ip: destination.hostname
      success_cache:
        capacity.initial: 1000
        capacity.max: 10000
      failure_cache:
        capacity.initial: 1000
        capacity.max: 10000
        ttl: 1m
      timeout: 500ms
      tag_on_failure: [_dns_reverse_lookup_failed]

How can i combine this whit "when.network.source.ip: private" so only DNS lookup for private network are done?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.