I would like to filter the DNS traffic coming to machine A based on a list of domains; in other words, for every query, if the domain requested is in the list I would like packetbeat to forward the DNS request to elasticsearch and ignore/drop every query that does not request any of the domains in the list.
Is this feasible?
Edit: I apologize for the vague question, I know that events can be excluded via processors "drop_event" and applying conditions. However since I have a pretty big list (1 million record) I wonder how that could be done.
I don't know if I understood correctly; here's my best guess:
I could run logstash on machine A to receive the traffic (netflow module?), apply a filter using the elasticsearch filter plugin (which fetches the 1M list from elastic) and then push the result to elasticsearch?
From packetbeat you output all the DNS events to Logstash instead of Elasticsearch (logstash has the beats input plugin). Logstash does the filtering with any of the two filters and outputs to Elasticsearch.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.