# Having issue with DNS filter **URL:** \ **Category:** Logstash\ **Created:** [January 17, 2018, 7:25pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940 "2018-01-17T19:25:03Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![amb1s1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amb1s1/32/26566_2.png) [@amb1s1](https://discuss.elastic.co/u/amb1s1)\ **Post date:** [January 17, 2018, 7:25pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/1 "2018-01-17T19:25:03Z")
I'm using logstash as a NetFlow collector, and it is working well for a start. I'm getting all the flow, and I want to use filters to be able to resolve ips. I create a simple filter (my first one, but it is not working. I'm new with this, so bare with me. Here is the config file: ``` input { udp { host => "0.0.0.0" port => 2025 codec => netflow { versions => [9] } } } filter { dns { reverse => ["ipv4_dst_addr"] action => "replace" } } output { stdout { codec => rubydebug } elasticsearch { index => "conn-flow-netflow" hosts => "10.50.0.20" } } ``` Here is the error message that I'm getting on the logs: ``` [2018-01-17T14:17:47,338][WARN][logstash.filters.dns] DNS filter could not perform reverse lookup on missing field {:field=>"ipv4_dst_addr"} ``` I will appreciate if any help. ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [January 17, 2018, 7:58pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/2 "2018-01-17T19:58:49Z")
Looks like the "ipv4\_dst\_addr" field doesn't exist. What fields do you see in the output when you leave the dns filter out of the config? ---
**Author:** ![amb1s1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amb1s1/32/26566_2.png) [@amb1s1](https://discuss.elastic.co/u/amb1s1)\ **Post date:** [January 17, 2018, 8:03pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/3 "2018-01-17T20:03:19Z")
How do I look into that? I see the field on Kibana. Is there a way to see it on logstash?, but I do see the field in Kibana. ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [January 17, 2018, 8:10pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/4 "2018-01-17T20:10:21Z")
according to the config you posted you have the logs output to stdout, so you should see them in your terminal when you start logstash from the command line ---
**Author:** ![amb1s1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amb1s1/32/26566_2.png) [@amb1s1](https://discuss.elastic.co/u/amb1s1)\ **Post date:** [January 17, 2018, 8:14pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/5 "2018-01-17T20:14:43Z")
This is what I get on the log: `[2018-01-17T15:14:03,956][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 11, column 1 (byte 130) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in`compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in`block in compile\_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in`compile\_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:171:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:335:in`block in converge\_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:332:in`block in converge\_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:319:in`converge\_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:343:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}` ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [January 17, 2018, 8:25pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/6 "2018-01-17T20:25:07Z")
That looks like an invalid logstash configuration. To see if the netflow codec creates the "ipv4\_dst\_addr" field it should be as simple as this: ``` input { udp { host => "0.0.0.0" port => 2025 codec => netflow { versions => [9] } } } output { stdout { codec => rubydebug } } ``` ---
**Author:** ![amb1s1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amb1s1/32/26566_2.png) [@amb1s1](https://discuss.elastic.co/u/amb1s1)\ **Post date:** [January 17, 2018, 9:40pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/7 "2018-01-17T21:40:25Z")
I still see the same output. I wonder where is the rubydebug? because the log that I'm checking is in this file: ``` /var/log/logstash/logstash-plain.log ``` ---
**Author:** ![amb1s1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amb1s1/32/26566_2.png) [@amb1s1](https://discuss.elastic.co/u/amb1s1)\ **Post date:** [January 17, 2018, 10:34pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/8 "2018-01-17T22:34:56Z")
I got it, I just needed to go to the logstash.yml and enable debug from there. Here is my output: ``` [2018-01-17T17:28:47,849][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :in_pkts]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :in_bytes]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:ip4_addr, :ipv4_src_addr]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:ip4_addr, :ipv4_dst_addr]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :input_snmp]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :output_snmp]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :last_switched]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :first_switched]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint16, :l4_src_port]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint16, :l4_dst_port]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :src_as]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint32, :dst_as]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:ip4_addr, :bgp_ipv4_next_hop]} [2018-01-17T17:28:47,850][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint8, :src_mask]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint8, :dst_mask]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint8, :protocol]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint8, :tcp_flags]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint8, :src_tos]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint8, :direction]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:forwarding_status, :forwarding_status]} [2018-01-17T17:28:47,851][DEBUG][logstash.codecs.netflow] Field definition complete for template 260 {:field=>[:uint16, :flow_sampler_id]} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 14, 2018, 10:35pm UTC](https://discuss.elastic.co/t/having-issue-with-dns-filter/115940/9 "2018-02-14T22:35:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.