# Zeek DNS Logs Into Top DNS Domains Section **URL:** \ **Category:** SIEM\ **Created:** [July 23, 2019, 6:13pm UTC](https://discuss.elastic.co/t/zeek-dns-logs-into-top-dns-domains-section/191888 "2019-07-23T18:13:17Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MrTrav](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@MrTrav](https://discuss.elastic.co/u/MrTrav)\ **Post date:** [July 23, 2019, 6:13pm UTC](https://discuss.elastic.co/t/zeek-dns-logs-into-top-dns-domains-section/191888/1 "2019-07-23T18:13:17Z")
Is there a way to get the data from the Zeek DNS logs into the Top DNS Domains panel in the SIEM? ---
**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\ **Post date:** [July 29, 2019, 10:35am UTC](https://discuss.elastic.co/t/zeek-dns-logs-into-top-dns-domains-section/191888/2 "2019-07-29T10:35:29Z")
Are you using the Zeek module in Filebeat? At the moment, it does not yet support ECS but uses its own format, and so the data wouldn't show up. We're working on adding DNS to ECS ([https://github.com/elastic/ecs/pull/438](https://github.com/elastic/ecs/pull/438)), and then we can move the Zeek module to use those common fields. In the meantime, you could do your own mapping with Filebeat processors and/or an Ingest pipeline. The fields behind the columns of the `Top DNS Domains` table are: - dns.question.etld\_plus\_one - dns.question.name - source.bytes - destination.bytes - dns.question.type (e.g. `PTR`) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 26, 2019, 10:35am UTC](https://discuss.elastic.co/t/zeek-dns-logs-into-top-dns-domains-section/191888/3 "2019-08-26T10:35:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.