# Graylog DNS Plugin

**URL:** <https://community.graylog.org/t/graylog-dns-plugin/6280>\
**Category:** Graylog Add-ons\
**Created:** [August 7, 2018, 7:49am UTC](https://community.graylog.org/t/graylog-dns-plugin/6280 "2018-08-07T07:49:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shenke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shenke/32/5961_2.png) [@shenke](https://community.graylog.org/u/shenke)\
**Post date:** [August 7, 2018, 7:49am UTC](https://community.graylog.org/t/graylog-dns-plugin/6280/1 "2018-08-07T07:49:18Z")

</div>

Hi all,

maybe I miss something, but I don’t know how to get the DNS resolver plugin working.  
Got it from here: [GitHub - graylog-labs/graylog-plugin-dnsresolver: Message filter plugin to reverse lookup the source field](https://github.com/graylog-labs/graylog-plugin-dnsresolver)

The plugin file is placed in the right folder, the server is restarted. I can see it in the log file as loaded:

> ```
> 2018-08-07T09:30:01.503+02:00 INFO [CmdLineTool] Loaded plugin: DnsResolverFilter 1.2.0 [org.graylog.plugin.filter.dns.DnsResolverFilterPlugin]
> 
> ```

What should I do next to see results?  
Is it something with the format of the message? I had a look in the source files but wasn’t sure, what’s wrong.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [August 7, 2018, 1:49pm UTC](https://community.graylog.org/t/graylog-dns-plugin/6280/2 "2018-08-07T13:49:16Z")

</div>

The readme reveals:

> This message filter plugin can be used to do DNS lookups for the `source` field in Graylog messages.

It will just try the above - if possible. No configuration needed/possible.

---

<div class="post-metadata">

**Author:** ![shenke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shenke/32/5961_2.png) [@shenke](https://community.graylog.org/u/shenke)\
**Post date:** [August 8, 2018, 12:32pm UTC](https://community.graylog.org/t/graylog-dns-plugin/6280/3 "2018-08-08T12:32:47Z")

</div>

Hmkay.  
Since the term “source” is used in different ways throughout the docs I found, I thought, I could use this plugin for reverse lookup of the src\_ip and dst\_ip.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [August 8, 2018, 2:28pm UTC](https://community.graylog.org/t/graylog-dns-plugin/6280/4 "2018-08-08T14:28:08Z")

</div>

you would need to use a lookup table for that - but the current release does not include the dns resolver. You would need to write your own lookup adapter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 22, 2018, 2:28pm UTC](https://community.graylog.org/t/graylog-dns-plugin/6280/5 "2018-08-22T14:28:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.