How to make PTR query using function?

Hi Team,

I am collecting BIND logs and being parsed properly. However wanted to seek your ideas if below can be achieved using graylog pipelines?

among the bind logs one of the field I am collecting is client who is querying which is coming as IP addresses. If I can do a PTR or ping -a to that host I get the hostname that way it is pretty easy to identify hence wondering if function or pipeline can be written to achieve the same?

23-Nov-2018 08:09:47.429 client ( query: IN A +E (

C:\Users\neo>ping -a

Pinging DESKTOP-TUSS$$F [] with 32 bytes of data:

I wrote a simple www server with perl. The server receives http queries (that graylog HTTP data adapter can send), makes a reverse dns query with the IP address found in the query and replies with a json reply. Works nicely, but of course it is a hack.

If I understand correctly, version 2.5.0 will support DNS queries natively (

1 Like

@blason the upcoming 2.5 will have DNS Lookup Table as @jtkarvo already pointed out.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.