Andrew Elwell
11/07/2025, 5:10 AM- name: content_modifier
action: extract
key: 'message'
# print one line per reply, with time, IP, name, type, class, rcode, timetoresolve, fromcache and responsesize.
pattern: '^(?<source_ip>[^ ]+) (?<query_request>[^ ]+) (?<query_record_type>[^ ]+) (?<query_class>[^ ]+) (?<query_result>[^ ]+) (?<unbound_time_to_resolve>[^ ]+) (?<unbound_from_cache>[^ ]+) (?<query_response_length>.+)$'
condition:
op: and
rules:
- field: '$message_type'
op: eq
value: 'reply'
- name: content_modifier
action: convert
key: unbound_time_to_resolve
converted_type: int
- name: content_modifier
action: convert
key: query_response_length
converted_type: int
- name: content_modifier
action: convert
key: unbound_from_cache
converted_type: boolean
but I'm still getting
[3] log_unbound: [[1762491366.000000000, {}], {"process"=>"unbound", "pid"=>934, "tid"=>"1", "message_type"=>"reply", "message"=>"127.0.0.1 <http://vmetrics1.pawsey.org.au|vmetrics1.pawsey.org.au>. AAAA IN NOERROR 0.000000 1 109", "gim_event_type_code"=>"140200", "source_ip"=>"127.0.0.1", "query_request"=>"vmetrics1.pawsey.org.au.", "query_record_type"=>"AAAA", "query_class"=>"IN", "query_result"=>"NOERROR", "unbound_time_to_resolve"=>"0.000000", "unbound_from_cache"=>"1", "query_response_length"=>"109", "cluster"=>"DNS", "event_reporter"=>"ns0"}]