gistfile1.txt

  mutate {
    type => "PaloAltoTestTrafficLog"
    # for dns queries
    replace => [ "SourceAddressFQDN", "%{SourceAddress}" ]
    replace => [ "DestinationAddressFQDN", "%{DestinationAddress}" ]
  }

  dns {
    type => "PaloAltoTestTrafficLog"
    reverse => [ "SourceAddressFQDN","DestinationAddressFQDN" ]
    action => "replace"
  }