# Formatting Windows DNS logs
**URL:** https://discuss.elastic.co/t/formatting-windows-dns-logs/46231
**Category:** Beats
**Tags:** filebeat
**Created:** [April 4, 2016, 11:57am UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231 "2016-04-04T11:57:04Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)
#### Post date: [April 4, 2016, 11:57am UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231/1 "2016-04-04T11:57:04Z")
I'm successfully using filebeat to ship DNS debug logs from our Windows DC servers to elk. I've finally figured out turning off 'analyzed' on the domain name field so that the name isn't broken into chunks (ie [Microsoft.com](http://Microsoft.com) became 'microsoft' and 'com'. Now I'm at a stage where I need to format the name to remove the numbers in the name
(7)outlook(9)office365(3)com(0)
Can anyone help me with this? If you need any logs just let me know...thx
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 4, 2016, 12:24pm UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231/2 "2016-04-04T12:24:47Z")
I think you could use the Logstash mutate filter's [gsub](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub) to remove the numbers. Here's an untested example (it may need some escaping).
```auto
filter {
mutate {
gsub => [
"domain_name_field", "(\d+)", "."
]
}
}
```
---
### Author:  [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)
#### Post date: [April 4, 2016, 11:20pm UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231/3 "2016-04-04T23:20:52Z")
First off....I huge thankyou. I'm no coder so the simplest things seem difficult..haha. Here is what I did as well as the results:
```auto
filter {
mutate {
gsub => [
"dns_query_name", "(\d+)", "."
]
}
}
filter {
mutate {
gsub => [
"dns_query_name", "\(", ""
]
}
}
filter {
mutate {
gsub => [
"dns_query_name", "\)", ""
]
}
}
```
Probably really unorthodox but it removed the brackets 🙂 I'm guessing I can probably do all the formatting on one line?
So something like:
(3)www(6)office(4)live(3)com(0)
became:
.www.office.live.com.
I do see some strange entries with too many dots but this is a huge improvement THANKYOU
Dave
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 5, 2016, 12:42am UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231/4 "2016-04-05T00:42:22Z")
I think I understand what you need a little better now.
```auto
filter {
mutate {
gsub => [
# Remove leading (n)
"dns_query_name", "^\(\d+\)", "",
# Remove trailing (n)
"dns_query_name", "\(\d+\)$", "",
# Replace inner (n)
"dns_query_name", "\(\d+\)", "."
]
}
}
```
That should change
`(3)www(6)office(4)live(3)com(0)`
to
`www.office.live.com`
If you need an custom analyzer for DNS names to make them searchable (i.e. search [live.com](http://live.com) and get back matching sub-domains like [www.office.live.com](http://www.office.live.com)) then you can adapt this [index template](https://github.com/elastic/examples/blob/master/packetbeat_dns_tunnel_detection/packetbeat-dns.template.json) to your needs. You would need to change the index name and modify the mappings section apply the analyzer to your `dns_query_name` field.
---
### Author:  [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)
#### Post date: [April 5, 2016, 1:07am UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231/5 "2016-04-05T01:07:06Z")
This worked perfectly. It cleaned up all the mess from the way I was trying to do it 🙂 I may try making it searchable in the future. For now, this is all I need. Thx for you help 🙂
Dave
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231/6 "2017-07-05T21:53:48Z")