dmachard / go-dnscollector

Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata.
MIT License
184 stars 43 forks source link

add custom text format with jinja templating #748

Closed dmachard closed 1 month ago

dmachard commented 1 month ago

fix #587

New text format with jinja template

global:
  text-jinja: |+
    ;; Got {% if dm.DNS.Type == "QUERY" %}query{% else %}answer{% endif %} from {{ dm.NetworkInfo.QueryIP }}#{{ dm.NetworkInfo.QueryPort }}:
    ;; ->>HEADER<<- opcode: {{ dm.DNS.Opcode }}, status: {{ dm.DNS.Rcode }}, id: {{ dm.DNS.ID }}
    ;; flags: {{ dm.DNS.Flags.QR | yesno:"qr ," }}{{ dm.DNS.Flags.RD | yesno:"rd ," }}{{ dm.DNS.Flags.RA | yesno:"ra ," }}; QUERY: {{ dm.DNS.QuestionsCount }}, ANSWER: {{ dm.DNS.DNSRRs.Answers | length }}, AUTHORITY: {{ dm.DNS.DNSRRs.Nameservers | length }}, ADDITIONAL: {{ dm.DNS.DNSRRs.Records | length }}

    ;; QUESTION SECTION:
    ;{{ dm.DNS.Qname }}     {{ dm.DNS.Qclass }} {{ dm.DNS.Qtype }}

    ;; ANSWER SECTION: {% for rr in dm.DNS.DNSRRs.Answers %}
    {{ rr.Name }}       {{ rr.TTL }} {{ rr.Class }} {{ rr.Rdatatype }} {{ rr.Rdata }}{% endfor %}

    ;; WHEN: {{ dm.DNSTap.Timestamp }}
    ;; MSG SIZE  rcvd: {{ dm.DNS.Length }}

Output example

;; Got query from 172.19.0.1#58505:
;; ->>HEADER<<- opcode: 0, status: NOERROR, id: 51670
;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.apple.com          IN      A

;; ANSWER SECTION: 

;; WHEN: 1718995587930350802
;; MSG SIZE  rcvd: 54

;; Got answer from 172.19.0.1#58505:
;; ->>HEADER<<- opcode: 0, status: NOERROR, id: 51670
;; flags: qr rd ra ; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.apple.com          IN      A

;; ANSWER SECTION: 
www.apple.com           881 IN CNAME www.apple.com.edgekey.net
www.apple.com.edgekey.net               2681 IN CNAME www.apple.com.edgekey.net.globalredir.akadns.net
www.apple.com.edgekey.net.globalredir.akadns.net                3599 IN CNAME e6858.dscx.akamaiedge.net
e6858.dscx.akamaiedge.net               19 IN A 2.21.145.39

;; WHEN: 1718995587946111311
;; MSG SIZE  rcvd: 192