# How does filter-dns handle multiple results?

**URL:** <https://discuss.elastic.co/t/how-does-filter-dns-handle-multiple-results/86677>\
**Category:** Logstash\
**Created:** [May 22, 2017, 1:37pm UTC](https://discuss.elastic.co/t/how-does-filter-dns-handle-multiple-results/86677 "2017-05-22T13:37:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jahlives](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jahlives](https://discuss.elastic.co/u/jahlives)\
**Post date:** [May 22, 2017, 1:37pm UTC](https://discuss.elastic.co/t/how-does-filter-dns-handle-multiple-results/86677/1 "2017-05-22T13:37:57Z")

</div>

I'm currently useing filter-dns to perform rdns queries on a given field.  
Config looks as follows:

```
dns {
  reverse => ["clientip"]
  action => "append"
}
if ( "" in [clientip][1] and [clientip][1] != '1' ) {
 mutate {
  add_field => ["rdnsname", "%{[clientip][1]}" ]
  replace => ["clientip", "%{[clientip][0]}" ]
 }
} else if ( "" in [clientip][1] and [clientip][1] == '1' ) {
 mutate {
  add_field => ["rdnsname", "NXDOMAIN"]
 }
}

```

the above works fine if rdns lookup only returns one result.  
Does anyone know how the result looks like if the rdns lookup returns more than one name?  
Will they be added like  
[clientip][1]  
[clientip][2]  
[clientip][3]  
or will they be added as  
[clientip][1][1]  
[clientip][1][2]  
[clientip][1][3]  
?  
The other question would be: is it possible to join an array to string, BUT WITHOUT the first element?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2017, 1:38pm UTC](https://discuss.elastic.co/t/how-does-filter-dns-handle-multiple-results/86677/2 "2017-06-19T13:38:06Z")

</div>

Closed on June 19, 2017, 1:38pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.