A dns filter will return as soon as an element in the array fails to resolve. An issue about that has been open for years. That means that if src_hostname fails to resolve (perhaps because it is a reserved address) it will never attempt to resolve dst_hostname.
If you split the dns filter into two dns filters does dst_hostname resolve?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.