Microsoft DNS Server integration - remove dot at domainn name's end

Zer0-cyber-web
Fri, 25 Jul 2025 06:55:10 +0000
Elastic Agent

Hi!
Could someone point me where to look: in Microsoft DNS Server index, there is a field with requested domain name - dns.question.name. It contains domain name that was requested by client. The only problem is that after parsing from oroginal Windows server log - it contains additional dot at the end:

lh3.google.com.

so it could look like:

lh3.google.com

Is there any way to get rid of this dot, so I could use this field in Custom match rule?
Thanks a lot in advance.

PS: Just in case data_stream.dataset: microsoft_dnsserver.analytical

9 posts - 2 participants