# Need help with BIND DNS Pattern

**URL:** <https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231>\
**Category:** Logstash\
**Created:** [November 27, 2017, 2:11pm UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231 "2017-11-27T14:11:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 27, 2017, 2:11pm UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231/1 "2017-11-27T14:11:42Z")

</div>

Hi Guys,

I am bit stuck up in parsing BIND DNS logs and need help since something is wrong and patterns are not being matched.

Here is the log

27-Nov-2017 18:57:19.747 client 10.1.1.10#53338 ([ericweb.co.za](http://ericweb.co.za)): query: [ericweb.co.za](http://ericweb.co.za) IN A +E (10.1.1.33)

and here are my parsers

(?%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) client %{IPORHOST:clientip}#%{NUMBER:port}: query: (?[a-z0-9-]+.[a-z0-9-]+\S+) IN %{WORD:recType} + (%{IPORHOST:DNSIP})

Can someone please help?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 28, 2017, 3:52pm UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231/2 "2017-11-28T15:52:10Z")

</div>

It looks like you've forgotten to match " ([ericweb.co.za](http://ericweb.co.za))" between the port number and "query: ".

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 30, 2017, 3:12am UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231/3 "2017-11-30T03:12:31Z")

</div>

Hmm..have facing challenges and need help with. I am not able to map DAYMONTH which is beginning at the line. And then brackets at the end for IP addresses.

client 10.1.1.10#53338 ([ericweb.co.za](http://ericweb.co.za)): query: [ericweb.co.za](http://ericweb.co.za) IN A (10.1.1.33)

client %{IPV4:clientip}#%{POSINT:clientport} (%{GREEDYDATA:query}): query: %{GREEDYDATA:Target} IN %{GREEDYDATA:querytype} (%{IPV4:src\_ip}) --\> This does not match

And with this

client 10.1.1.10#53338 ([ericweb.co.za](http://ericweb.co.za)): query: [ericweb.co.za](http://ericweb.co.za) IN A 10.1.1.33

It matches perfectly --\>

client %{IPV4:clientip}#%{POSINT:clientport} (%{GREEDYDATA:query}): query: %{GREEDYDATA:Target} IN %{GREEDYDATA:querytype} (%{IPV4:src\_ip})

Any clue how do I match dates & those brackets?

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 30, 2017, 3:14am UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231/4 "2017-11-30T03:14:07Z")

</div>

OK Able to resolve my second issue with this

client %{IPV4:clientip}#%{POSINT:clientport} (%{GREEDYDATA:query}): query: %{GREEDYDATA:Target} IN %{GREEDYDATA:querytype} ((%{IPV4:src\_ip}))

Now the only issue is with date

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 30, 2017, 3:17am UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231/5 "2017-11-30T03:17:25Z")

</div>

> [@Blason](#):
>
> (?%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME})

I guess even that worked

%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME} client %{IPV4:clientip}#%{POSINT:clientport} (%{GREEDYDATA:query}): query: %{GREEDYDATA:Target} IN %{GREEDYDATA:querytype} ((%{IPV4:src\_ip}))

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2017, 3:17am UTC](https://discuss.elastic.co/t/need-help-with-bind-dns-pattern/109231/6 "2017-12-28T03:17:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.