---
title: 'filebeat bind plugin'
url: 'https://willifix.net/blog/filebeat-bind-plugin'
markdown: 'https://willifix.net/blog/filebeat-bind-plugin.md'
date: '2024-02-07'
description: 'After the successful Setup of our Elasticsearch Cluster we noticed that the logs of the bind nameserver are not really stored in the index of the filebeat agent in a meaningful way. so what can you do to solve this problem? Filebeat rwbind Module First for the Insiders the Module can be donwloaded …'
---

# filebeat bind plugin

## [filebeat bind plugin](https://willifix.net/blog/filebeat-bind-plugin)

    7th Feb 2024  

After the successful Setup of our Elasticsearch Cluster we noticed that the logs of the bind nameserver are not really stored in the index of the filebeat agent in a meaningful way.

so what can you do to solve this problem?

##### Filebeat rwbind Module

First for the Insiders the Module can be donwloaded here: [rwbind.tar](https://willifix.net/blog/filebeat-bind-plugin/rwbind.tar)

if you prefer the manual way here is the ingest-pipeline:

```json
[
  {
    "grok": {
      "field": "message",
      "patterns": [
        "^%{TIMESTAMP_ISO8601:timestamp} queries: %{LOGLEVEL:loglevel}: client(:? @0x(?:[0-9A-Fa-f]+))? %{IP:clientip}#%{POSINT:clientport} \\(%{GREEDYDATA:query}\\): query: %{GREEDYDATA:query} IN %{GREEDYDATA:querytype} \\(%{IP:dnsserver}\\)"
      ]
    }
  },
  {
    "date": {
      "timezone": "+0100",
      "field": "timestamp",
      "formats": [
        "ISO8601"
      ],
      "target_field": "@timestamp"
    }
  },
  {
    "rename": {
      "target_field": "client.port",
      "field": "clientport"
    }
  },
  {
    "rename": {
      "ignore_missing": true,
      "field": "clientip",
      "target_field": "client.ip"
    }
  },
  {
    "remove": {
      "field": "timestamp",
      "ignore_missing": true
    }
  }
]
```

have fun Raffael

 [ Previous Post](https://willifix.net/blog/icinga2-check_ssl_cert) [Next Post ](https://willifix.net/blog/nvidia-dkms-sway-config)

---

## Navigation

- Parent: [Blog](https://willifix.net/blog.md)
- Previous: [NVIDIA-DKMS sway Config](https://willifix.net/blog/nvidia-dkms-sway-config.md)
- Next: [icinga2 check_ssl_cert](https://willifix.net/blog/icinga2-check_ssl_cert.md)