Grok Pattern DNS Querys send via syslogd


we have a DNS server and send all dns queries to logstash / elastic.

The message line seems to be like this:

<30>Jan 8 12:32:35 10.243.XX.XX named[21826]: queries: client 10.243.YY.YY#43789 ( query: IN PTR + (10.243.ZZ.ZZ)

<30>Jan 8 13:19:27 10.243.XX.XX named[21826]: queries: client 10.32.YY.YY#61494 (corppki.mydomain.dom): query: corppki.mydomain.dom IN A +ED (10.243.XX.XX)

I would split to:

  • dns server
  • query client
  • query destination

I also would put 12:32:35 in timestamp.

I found following link:

but I don't know how to implement it.

Any Idea?


This could easily be done with a custom grok filter. This document should help with that.

--Bryan Vest

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.