logstash dns filter miss

Question

I am using logstash 1.5 in my ELK stack environment. with the following filter configuration:

filter {
   mutate {
      add_filed => { "src_ip" => "%{src}" }
      add_filed => { "dst_ip" => "%{dst}" }
   }
   dns {
      reverse => [ "src", "dst" ]
      action => "replace"
   }
}

I have 2 problems:

• The filter is missing or skip the dns reverse proccess on many logs - I mean each log that going in the filter process or that both dst and src fields reverse or not at all and remain with the ip ( when i test with nslookup all the ip fields has names in the dns).
• I dont know how and why but some of my logs has multiple values and i get the following error:

DNS: skipping reverse, can't deal with multiple values, :field=>"src" , :value=>["10.0.0.1","20.0.0.2"], : level=> warn

It looks like my (ELK) logstash cant handle with a lot of logs and resolve them fast enough. also its looks that he create array keys of multiple value from different logs.

any idea? maybe you guys encounter this problem?

Answer 1

I noticed a typo in your configuration - add_filed should be add_field