# Bind DNS queries extractor

**URL:** <https://community.graylog.org/t/bind-dns-queries-extractor/23047>\
**Category:** Other Solutions\
**Tags:** other\_solutions\
**Created:** [March 14, 2022, 5:30pm UTC](https://community.graylog.org/t/bind-dns-queries-extractor/23047 "2022-03-14T17:30:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [March 14, 2022, 5:30pm UTC](https://community.graylog.org/t/bind-dns-queries-extractor/23047/1 "2022-03-14T17:30:01Z")

</div>

# Bind DNS queries extractor

@ozalpmurat

[View on Github](https://github.com/ozalpmurat/Bind-DNS-Graylog-Extractor)  
[Open Issues](https://github.com/ozalpmurat/Bind-DNS-Graylog-Extractor/issues)  
[Stargazers](https://github.com/ozalpmurat/Bind-DNS-Graylog-Extractor/stargazers)

## Example log

`06-Mar-2021 13:34:44.911 queries: info: client 10.9.9.3#35510 (www.bilecik.edu.tr): query: www.bilecik.edu.tr IN A -EDC (192.168.1.1)`

## Grok pattern

`%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME} queries: info: client %{IPV4:client_ip}%{DATA} \(%{DATA:query}\)`

## Extracted fields

- MONTHDAY
- MONTH
- YEAR
- TIME
- HOUR
- MINUTE
- SECOND
- client\_ip
- query