# Logstash DNS Filter - Enrichment security example

**URL:** <https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040>\
**Category:** Logstash\
**Created:** [February 22, 2018, 11:58am UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040 "2018-02-22T11:58:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [February 22, 2018, 11:58am UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040/1 "2018-02-22T11:58:21Z")

</div>

Hi All,

I was trying to execute the Data enrichment logstash -IP addresses exist in an external DNSBL (DNS Blocklist)?

> **[Data Enrichment - Security Examples](https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples)**
>
> Data enrichment provides additional insights into your data, and is frequently used in Security use cases. Enrich your data with blacklists, asset inventories, and detect malware.

```auto
filter {
   grok {
     match => { "message" => "%{WORD:addr1}.%{WORD:addr2}.%{WORD:addr3}.%{WORD:addr4}" } <= extract different part of the IP address 
   }
   mutate {
     add_field => {
     "spamhaus_reverse_lookup" => "%{addr4}.%{addr3}.%{addr2}.%{addr1}.zen.spamhaus.org" . <= reformat the address for spamhaus query
     }
   }
   dns {
     resolve => ["spamhaus_reverse_lookup"] <= perform lookup using the reverse address format.
     nameserver => ["x.x.x.x"]
     add_tag => ["dns_successful_lookup"]
     action => replace
   }
   if "dns_successful_lookup" in [tags] {
     if [spamhaus_reverse_lookup] == "127.0.0.2" { <= 127.0.0.2 is a special return address from spamhaus that indicate the lookup address is listed in spamhaus spam database
       mutate {
          add_tag => ["spam_address"]
       }
     }
   }
}

```

I get a message stating  
[FATAL] 2018-02-22 12:41:53.785 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, and, or, xor, nand, { at line 19, column 8 (byte 533) after filter {

But if I comment out the last section the filter it works fine ,am not sure whats the problem with that.

```auto
filter {
  if [type] == "spam" {
   grok {
     match => { "message" => "%{WORD:addr1}.%{WORD:addr2}.%{WORD:addr3}.%{WORD:addr4}" }
    }
   mutate {
     add_field => {
     "spamhaus_reverse_lookup" => "%{addr4}.%{addr3}.%{addr2}.%{addr1}.zen.spamhaus.org"
     }
   }
   dns {
     resolve => ["spamhaus_reverse_lookup"]
     nameserver => ["x.x.x.x"]
     add_tag => ["dns_successful_lookup"]
     action => replace
   }
# if "dns_successful_lookup" in [tags] {
# if [spamhaus_reverse_lookup] == "127.0.0.2"
# mutate {
# add_tag => ["spam_address"]
# }
# }
  }
}

Please do let me know what could be the problem in the logstash filter.

Thanks,
Raj
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 23, 2018, 2:26pm UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040/2 "2018-02-23T14:26:14Z")

</div>

Do you actually have the "\<=" comments in your configuration file? Remove them, and watch out for the period at the end of one of the lines in the first mutate filter.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [February 23, 2018, 6:34pm UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040/3 "2018-02-23T18:34:30Z")

</div>

Thank you for the reply , actually I copied that configuration from that blog but my configuration looks like this

```auto
filter {
  if [type] == "spam" {
   grok {
     match => { "message" => "%{WORD:addr1}.%{WORD:addr2}.%{WORD:addr3}.%{WORD:addr4}" }
    }
   mutate {
     add_field => {
     "spamhaus_reverse_lookup" => "%{addr4}.%{addr3}.%{addr2}.%{addr1}.zen.spamhaus.org"
     }
   }
   dns {
     resolve => ["spamhaus_reverse_lookup"]
     nameserver => ["x.x.x.x"]
     add_tag => ["dns_successful_lookup"]
     action => replace
   }
   if "dns_successful_lookup" in [tags] {
     if [spamhaus_reverse_lookup] == "127.0.0.2"
       mutate {
          add_tag => "spam_address"
        }
    }
  }
}

```

Then i tried comment out the last section the filter like this

```auto
filter {
  if [type] == "spam" {
   grok {
     match => { "message" => "%{WORD:addr1}.%{WORD:addr2}.%{WORD:addr3}.%{WORD:addr4}" }
    }
   mutate {
     add_field => {
     "spamhaus_reverse_lookup" => "%{addr4}.%{addr3}.%{addr2}.%{addr1}.zen.spamhaus.org"
     }
   }
   dns {
     resolve => ["spamhaus_reverse_lookup"]
     nameserver => ["x.x.x.x"]
     add_tag => ["dns_successful_lookup"]
     action => replace
   }
# if "dns_successful_lookup" in [tags] {
# if [spamhaus_reverse_lookup] == "127.0.0.2"
# mutate {
# add_tag => ["spam_address"]
# }
# }
  }
}

```

it works fine.Please let me know what could be the problem  
Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 24, 2018, 2:12pm UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040/4 "2018-02-24T14:12:15Z")

</div>

There's a `{` missing from the `if [spamhaus_reverse_lookup] == "127.0.0.2"` line.

This it stuff you can debug by commenting out pieces of the configuration until you narrow thing down to a single line or two.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [February 25, 2018, 9:30am UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040/5 "2018-02-25T09:30:05Z")

</div>

Thank you for the reply

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2018, 9:30am UTC](https://discuss.elastic.co/t/logstash-dns-filter-enrichment-security-example/121040/6 "2018-03-25T09:30:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.