DNS Reverse Lookup

The dns processor performs reverse DNS lookups of IP addresses. It caches the responses that it receives in accordance to the time-to-live (TTL) value contained in the response. It also caches failures that occur during lookups. Each instance of this processor maintains its own independent cache.

The processor uses its own DNS resolver to send requests to nameservers and does not use the operating system’s resolver. It does not read any values contained in /etc/hosts.

This processor can significantly slow down your pipeline’s throughput if you have a high latency network or slow upstream nameserver. The cache will help with performance, but if the addresses being resolved have a high cardinality, cache benefits are diminished due to the high miss ratio.

For example, if each DNS lookup takes 2 milliseconds, the maximum throughput you can achieve is 500 events per second (1000 milliseconds / 2 milliseconds). If you have a high cache hit ratio, your throughput can be higher.

This is a minimal configuration example that resolves the IP addresses contained in two fields.

- dns:
    type: reverse
    fields:
      source.ip: source.hostname
      destination.ip: destination.hostname

This examples shows all configuration options.

- dns:
  type: reverse
  action: append
  transport: tls
  fields:
    server.ip: server.hostname
    client.ip: client.hostname
  success_cache:
    capacity.initial: 1000
    capacity.max: 10000
    min_ttl: 1m
  failure_cache:
    capacity.initial: 1000
    capacity.max: 10000
    ttl: 1m
  nameservers: ['192.0.2.1', '203.0.113.1']
  timeout: 500ms
  tag_on_failure: [_dns_reverse_lookup_failed]