Skip to content

incorrect format for bind9 query log #100

@fawaf

Description

@fawaf

https://github.com/fluent/fluent-plugin-grok-parser/blob/master/patterns/bind#L3 is missing a hex matcher after client.

should be

BIND9 %{BIND9_TIMESTAMP:timestamp} queries: %{LOGLEVEL:loglevel}: client(:? @0x(?:[0-9A-Fa-f]+))? %{IP:clientip}#%{POSINT:clientport} \(%{GREEDYDATA:query}\): query: %{GREEDYDATA:query} IN %{GREEDYDATA:querytype} \(%{IP:dns}\)

according to https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/legacy/bind

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions