Grok query domain from DNS server log

[tatdat (Dat Pham Tat)]

Hi,

I'm using Elastic Stack V5.5 and using logstahs for parse log from DNS server log. Something like that

(6)mobile(4)pipe(4)aria(9)microsoft(3)com(0)
(7)outlook(6)office(3)com(0)
(5)nexus(10)officeapps(4)live(3)com(0)

Now i want parse query domain to friendly domain like

mobile.pipe.aria.microsoft.com
outlook.office.com
nexus.officeapps.live.com

How can do it?

Thanks so much!

[magnusbaeck (Magnus Bäck)]

How about using a mutate filter and its gsub option to replace \(\d+\) with a period?

[tatdat (Dat Pham Tat)]

Thank for your suggestion. It's worked, but i got string after used gsub

.mobile.pipe.aria.microsoft.com.

How to remove first and last dot (.) in string ?

[magnusbaeck (Magnus Bäck)]

How to remove first and last dot (.) in string ?

Use gsub to replace ^\. and \.$ with empty strings.

[tatdat (Dat Pham Tat)]

Thanks you so much!

My problem is solved!

Is config looklike that ?

filter {
  mutate {
    gsub => [     
      "domain", "\(\d+\)", ".",
      "domain", "^\.", "",
      "domain", "\.$", ""
    ]
  }
}