# Grok patterns for BIND DNS server

**URL:** <https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203>\
**Category:** Logstash\
**Created:** [April 22, 2016, 7:56pm UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203 "2016-04-22T19:56:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![icb](https://avatars.discourse-cdn.com/v4/letter/i/b2d939/32.png) [@icb](https://discuss.elastic.co/u/icb)\
**Post date:** [April 22, 2016, 7:56pm UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203/1 "2016-04-22T19:56:54Z")

</div>

Does anyone have a set of good grok patterns for the BIND DNS server query logs?

The messages I'm interested in look like this:  
`Apr 22 15:40:26 ns.example.com named[1351]: queries: info: client 192.0.2.215#53591: query: www.example.com IN A -ED (198.51.100.70)`

Most of it is easy, but the second to last field is a [bunch of flags](https://deepthought.isc.org/article/AA-00434/0/What-do-EDC-and-other-letters-I-see-in-my-query-log-mean.html) that I'm not sure how to parse.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2016, 4:09pm UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203/2 "2016-04-24T16:09:39Z")

</div>

> Most of it is easy, but the second to last field is a bunch of flags that I'm not sure how to parse.

Something like `[+-][SETDC]+` should work.

---

<div class="post-metadata">

**Author:** ![icb](https://avatars.discourse-cdn.com/v4/letter/i/b2d939/32.png) [@icb](https://discuss.elastic.co/u/icb)\
**Post date:** [April 24, 2016, 4:27pm UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203/3 "2016-04-24T16:27:38Z")

</div>

That lets the pattern match, but doesn't seem to quite quite get me where I want to be. I'm thinking maybe something with [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter to make the output easier to search later might work?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2016, 6:29pm UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203/4 "2016-04-24T18:29:05Z")

</div>

Well, you didn't tell us what result you desired. I'm not sure the translate filter will help you here. I'd probably use a ruby filter.

```auto
ruby {
  code => "
    event['signed'] = event['flags'].include? 'S'
    event['tcp'] = event['flags'].include? 'T'
    ...
  "
}

```

---

<div class="post-metadata">

**Author:** ![icb](https://avatars.discourse-cdn.com/v4/letter/i/b2d939/32.png) [@icb](https://discuss.elastic.co/u/icb)\
**Post date:** [April 24, 2016, 6:44pm UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203/5 "2016-04-24T18:44:54Z")

</div>

Sorry. You're right. I wasn't clear about my goal. I want to be able to easily access the individual flags, so I can do things like graph UDP vs. TCP transport.

I did manage to make it work with translate, but your suggestion is probably cleaner. Thank you for the suggestion.

```
grok {
    keep_empty_captures => true
    match => {
        "message" => "queries: info: client %{IP:clientip}#%{INT:port}: query: %{DATA:query} %{WORD:class} %{WORD:querytype} (?<recursive>[-+])((?<signed>S)?)((?<edns>E)?)((?<transport>T)?)((?<dnssec>D)?)((?<cd>C)?) \(%{IP:serverip}\)"
    }
}
translate {
    field => "recursive"
    destination => "[dns_flags][recursive]"
    remove_field => ["recursive"]
    dictionary => ["+", "Yes", "-", "No"]
}
translate {
    field => "signed"
    destination => "[dns_flags][signed]"
    remove_field => ["signed"]
    fallback => "No"
    dictionary => ["S", "Yes"]
}
translate {
    field => "edns"
    destination => "[dns_flags][edns]"
    remove_field => ["edns"]
    fallback => "No"
    dictionary => ["E", "Yes"]
}
translate {
    field => "transport"
    destination => "[dns_flags][transport]"
    remove_field => ["transport"]
    fallback => "UDP"
    dictionary => ["T", "TCP"]
}
translate {
    field => "dnssec"
    destination => "[dns_flags][dnssec]"
    remove_field => ["dnssec"]
    fallback => "No"
    dictionary => ["D", "Yes"]
}
translate {
    field => "cd"
    destination => "[dns_flags][cd]"
    remove_field => ["cd"]
    fallback => "No"
    dictionary => ["C", "Yes"]
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/grok-patterns-for-bind-dns-server/48203/6 "2017-07-06T05:00:57Z")

</div>