dnslookups

gistfile1.txt

  mutate {
    type => "PaloAltoTestTrafficLog"
    add_field => ["SourceAddressFQDN", ""]
    add_field => ["DestinationAddressFQDN", ""]
  }

  mutate {
    type => "PaloAltoTestTrafficLog"
    replace => [ "SourceAddressFQDN", "%{SourceAddress}" ]
    replace => [ "DestinationAddressFQDN", "%{DestinationAddress}" ]
  }

  dns {
    type => "PaloAltoTestTrafficLog"
    reverse => [ "SourceAddressFQDN","DestinationAddressFQDN" ]
    action => "replace"
  }