(?:Q|R Q))%{SPACE}[%{NUMBER:dns_flags_hex}%{SPACE}%{WORD:dns_flags_chars}%{SPACE}%{WORD:dns_response_code}]%{SPACE}%{WORD:dns_question_type}%{SPACE}%{GREEDYDATA:dns_question_name}" ]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][nxlog]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
stdout {
codec => rubydebug
}
}
```
Issue : I can not view my DNS logs on Kibana. Also configure a dashboard . I'm not sure of my configuration files for Logstash , especially the "filter" section and "output". However, when I type the command **ngrep INTERFACE -d -t -W byline** on my debian, I have queries that appears to be from my WS, so my logs are well received.
Could you help me ?
Thank you very much for your time ! And sorry for my english writing...
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 15, 2016, 2:46am UTC](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341/2 "2016-03-15T02:46:39Z")
Have you looked at using winlogbeat instead of nxlog?
[https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html)
I know that doesn't solve your problem immediately, but I am not sure how many people have nxlog experience - it's been a few years since I last used it.
---
### Author:  [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)
#### Post date: [March 20, 2016, 4:29pm UTC](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341/3 "2016-03-20T16:29:40Z")
Did you find a solution as I'm also trying to send DNS logs to Logstash and can't get it working. I'm using Winlogbeat for the Eventlogs but I don't think there is a way to send the DNS logs which are being captured in 'debug' mode to Logstash. I'm using the following config ( c:\dnslog\dnslogs.txt is where the
debug dns info is being saved)
## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at [http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html](http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html)
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
Module xm\_syslog Module xm\_json Module im\_file File 'C:\DNSLog\dnslogs.txt' SavePos TRUE InputType LineBased Exec $Message = $raw\_event; Module om\_tcp Host 172.20.1.239 Port 5041 Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; \ to\_json();
\
Path DNS =\> out
On the Logstash side I have the following
input {
beats {
port =\> 5041
type =\> "logs"
# ssl =\> false
# ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"
# ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"
}
}
---
### Author:  [@OncleThorgal](https://discuss.elastic.co/u/OncleThorgal)
#### Post date: [March 21, 2016, 10:59am UTC](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341/4 "2016-03-21T10:59:40Z")
Hello,
After investigation, I found that's because nxlog/winlogbeat/etc... haven't right for read this file C:\DNSLog\dnslogs.txt.
So, you need to specify another path to save your log, or add right to your program.
---
### Author:  [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)
#### Post date: [March 21, 2016, 1:18pm UTC](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341/5 "2016-03-21T13:18:32Z")
thx..I'll look into it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341/6 "2017-07-06T05:06:05Z")