My bind9 dns logs dont look like your dns logs, is it filebeat? logstash?

Elastic Stack Logstash
1

hi, i'm trying to pull in bind9 dns logs into elasticsearch..
my workflow is this:

  • filebeat transfers bind9 logs to logstash
  • logstash dumps them into a rabbitmq queue
  • another logstash instance on another machine pulls from rabbitmq and puts them into ES

on the dns server the logs look like this:
2019-06-05T17:37:42.753Z client @0x7f0b9466c8f0 172.XX.XX.XXX#48739: query

in rabbitmq and beyond the log entries look like this:
2019-06-05T17:37:42.753Z {name=edhelloXXXX, hostname=edhelloXXXXX, id=adee31d708b14ad19c1759d378a7788b, os={name=Ubuntu, family=debian, version=18.04.2 LTS (Bionic Beaver), kernel=4.15.0-47-generic, platform=ubuntu, codename=bionic}, containerized=false, architecture=x86_64} client @0x7f0b9466c8f0 172.XX.XX.XXX#48739: query

that additional data is throwing off any grok pattern i find online. i'm just curious at which stage that data is being inserted.. and if anyone else has had something like that happen..

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.