hi
i have installed pfense integratino in elasticsearch 9.5.5 using fleet.
i can see a dashboards but i cant see any data for the dashboard of unound.
in pfsense i have set to send everything to the elk syslog.
in elk when i run tcp dump on port 9001 and grep for unbound i see logs. as shown below,
but the dashboard is empty. this is plain simple installation following official documentaion.
sudo tcpdump -ni any -A 'udp port 9001 and host 192.168.2.1' | grep unbound
E...0h..@.........$..#)....<30>1 2026-10-23T13:12:51.445877+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 1.2.168.192.in-addr.arpa. PTR IN
E.......@.O........$..#)....<30>1 2026-10-23T13:12:51.445877+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 1.2.168.192.in-addr.arpa. PTR IN
E.......@..........$..#)...Y<30>1 2026-10-23T13:12:51.445929+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 1.2.168.192.in-addr.arpa. PTR IN NOERROR 0.000000 1 83
E....b..@..O.......$..#)...Y<30>1 2026-10-23T13:12:51.445929+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 1.2.168.192.in-addr.arpa. PTR IN NOERROR 0.000000 1 83
E....i..@..b.......$..#)....<30>1 2026-10-23T13:12:51.464721+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co.brat.net``. A IN
E...Ay..@..R.......$..#)....<30>1 2026-10-23T13:12:51.464721+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co.brat.net``. A IN
E...<...@..........$..#)..I.<30>1 2026-10-23T13:12:51.464772+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co.brat.net``. A IN NXDOMAIN 0.000000 1 108
E...<...@..........$..#)..I.<30>1 2026-10-23T13:12:51.464772+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co.brat.net``. A IN NXDOMAIN 0.000000 1 108
E.......@.]........$..#)..Y/<30>1 2026-10-23T13:12:51.482260+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co.brat.net``. AAAA IN
E...#...@..........$..#)..Y/<30>1 2026-10-23T13:12:51.482260+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co.brat.net``. AAAA IN
E......@..........$..#)...g<30>1 2026-10-23T13:12:51.482302+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co.brat.net``. AAAA IN NXDOMAIN 0.000000 1 108
E...k...@..........$..#)...g<30>1 2026-10-23T13:12:51.482302+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co.brat.net``. AAAA IN NXDOMAIN 0.000000 1 108
E.......@.+........$..#)....<30>1 2026-10-23T13:12:51.511632+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co``. A IN
E....b..@.tu.......$..#)....<30>1 2026-10-23T13:12:51.511632+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co``. A IN
E.......@..........$..#)..SP<30>1 2026-10-23T13:12:51.511673+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co``. A IN NOERROR 0.000000 1 44
E.......@.n........$..#)..SP<30>1 2026-10-23T13:12:51.511673+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co``. A IN NOERROR 0.000000 1 44
E...,...@..........$..#)..,.<30>1 2026-10-23T13:12:51.573359+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co``. AAAA IN
E...l...@..$.......$..#)..,.<30>1 2026-10-23T13:12:51.573359+05:00 abc unbound 42255 - - [42255:0] query: 192.168.5.230 ``elastic.co``. AAAA IN
E.......@..........$..#)....<30>1 2026-10-23T13:12:51.573400+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co``. AAAA IN NOERROR 0.000000 1 56
E....k..@.9S.......$..#)....<30>1 2026-10-23T13:12:51.573400+05:00 abc unbound 42255 - - [42255:0] reply: 192.168.5.230 ``elastic.co``. AAAA IN NOERROR 0.000000 1 56