# My bind9 dns logs dont look like your dns logs, is it filebeat? logstash? **URL:** \ **Category:** Logstash\ **Created:** [June 5, 2019, 5:47pm UTC](https://discuss.elastic.co/t/my-bind9-dns-logs-dont-look-like-your-dns-logs-is-it-filebeat-logstash/184433 "2019-06-05T17:47:52Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Post date:** [June 5, 2019, 5:47pm UTC](https://discuss.elastic.co/t/my-bind9-dns-logs-dont-look-like-your-dns-logs-is-it-filebeat-logstash/184433/1 "2019-06-05T17:47:52Z")
hi, i'm trying to pull in bind9 dns logs into elasticsearch.. my workflow is this: - filebeat transfers bind9 logs to logstash - logstash dumps them into a rabbitmq queue - another logstash instance on another machine pulls from rabbitmq and puts them into ES on the dns server the logs look like this: 2019-06-05T17:37:42.753Z client @0x7f0b9466c8f0 172.XX.XX.XXX#48739: query in rabbitmq and beyond the log entries look like this: 2019-06-05T17:37:42.753Z {name=edhelloXXXX, hostname=edhelloXXXXX, id=adee31d708b14ad19c1759d378a7788b, os={name=Ubuntu, family=debian, version=18.04.2 LTS (Bionic Beaver), kernel=4.15.0-47-generic, platform=ubuntu, codename=bionic}, containerized=false, architecture=x86\_64} client @0x7f0b9466c8f0 172.XX.XX.XXX#48739: query that additional data is throwing off any grok pattern i find online. i'm just curious at which stage that data is being inserted.. and if anyone else has had something like that happen.. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2019, 5:48pm UTC](https://discuss.elastic.co/t/my-bind9-dns-logs-dont-look-like-your-dns-logs-is-it-filebeat-logstash/184433/2 "2019-07-03T17:48:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.