- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Prior to 4.1, my host field reverse resolved (i.e. instead of ip addresses, it showed hostnames from DNS) for syslog data. This stopped when I upgraded to 4.1, so I'm trying to get it working again via lookups. I've got the lookup working when I direct the output to a new field:
dnslookup ip AS host OUTPUT host AS hostname
works fine, creates a new field "hostname" with the hostname data in it.
But when I just do:
dnslookup ip AS host OUTPUT host
The host field gets eliminated. What am I missing here? I really want my data to all have consistent host fields (i.e. only hostnames where they resolve, IP addresses if they can't).
Thanks Steve
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's probably better to just set connection_host = dns
to your UDP input stanza to resolve the old behavior. The lookup script you have is rather expensive to run on every unique IP on every single search.
You can not use a lookup to overwrite an incoming field value. If you really want to do this, set up a FIELDALIAS on the original field, and pass in the alias to the lookup. Again, not recommended for the long term.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For anyone actually trying to replace host, as Steve was asking about.
Here is one way to workaround the issue without doing all the FIELDALIAS
stuff:
... | eval ip=host | lookup dnslookup ip OUTPUT host AS hostname | eval host=coalesce(hostname,host) | eval ip=null()
If you have to use this in a number of your searches, you should consider making a macro for this
Note that if you already have the field ip
, you can simply swap it out for a different (unused) field name. This approach should allow any failed lookups to preserve their original host
value, which is what you want if your are dealing with a mix of hostnames and ip address in the host
field.
If you have a small list of hosts that you are renaming (like in this example, where due to a setup issue Steve now has historical data with ip address instead of hostnames) then it probably makes more sense to make a new static lookup table (make a small .csv file in the lookups
directory), rather than using an external lookup script, since using a static lookup file would be much faster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For anyone actually trying to replace host, as Steve was asking about.
Here is one way to workaround the issue without doing all the FIELDALIAS
stuff:
... | eval ip=host | lookup dnslookup ip OUTPUT host AS hostname | eval host=coalesce(hostname,host) | eval ip=null()
If you have to use this in a number of your searches, you should consider making a macro for this
Note that if you already have the field ip
, you can simply swap it out for a different (unused) field name. This approach should allow any failed lookups to preserve their original host
value, which is what you want if your are dealing with a mix of hostnames and ip address in the host
field.
If you have a small list of hosts that you are renaming (like in this example, where due to a setup issue Steve now has historical data with ip address instead of hostnames) then it probably makes more sense to make a new static lookup table (make a small .csv file in the lookups
directory), rather than using an external lookup script, since using a static lookup file would be much faster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's probably better to just set connection_host = dns
to your UDP input stanza to resolve the old behavior. The lookup script you have is rather expensive to run on every unique IP on every single search.
You can not use a lookup to overwrite an incoming field value. If you really want to do this, set up a FIELDALIAS on the original field, and pass in the alias to the lookup. Again, not recommended for the long term.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good call - I missed that in the doc.