fluent / fluent/fluent-plugin-grok-parser
incorrect format for bind9 query log
Open
- Dominant language
- Ruby
- Stars
- 108
- Forks
- 32
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/fluent/fluent-plugin-grok-parser/blob/master/patterns/bind#L3 is missing a hex matcher after `client`.
should be
```
BIND9 %{BIND9_TIMESTAMP:timestamp} queries: %{LOGLEVEL:loglevel}: client(:? @0x(?:[0-9A-Fa-f]+))? %{IP:clientip}#%{POSINT:clientport} \(%{GREEDYDATA:query}\): query: %{GREEDYDATA:query} IN %{GREEDYDATA:querytype} \(%{IP:dns}\)
```
according to https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/legacy/bind
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.