CoreDNS

Collect logs from CoreDNS instances with Elastic Agent.

Version
0.8.0 (View all)
Compatible Kibana version(s)
8.13.0 or higher
Supported Serverless project types

Security
Observability
Subscription level
Basic
Level of support
Elastic

This integration parses logs from CoreDNS instances.

Compatibility

This integration is designed to read CoreDNS logs running within a Kubernetes cluster or via systemd with logs output to journald. The CoreDNS datasets were tested with version 1.9.3 and 1.10.0.

Logs

The log data stream expects logs from the CoreDNS errors plugin and the log plugin. Query logs from the log plugin can be in either the common or combined format (see log format for details). An example configuration with logging enabled is:

. {
  forward . 8.8.8.8
  errors
  log
}

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

FieldDescriptionType
@timestamp
Event timestamp.
date
cloud.image.id
Image ID for the cloud instance.
keyword
coredns.log.buffer_size
The EDNS0 buffer size advertised in the query
long
coredns.log.dnssec_ok
The DO bit is included in a DNS query and is an abbreviation for "DNSSEC OK". If the DO bit is set (DO=1), then the client is DNSSEC-aware, and it is OK for the DNS server to return DNSSEC data in a response. If the DO bit is not set (DO=0), then the client is not DNSSEC-aware, and the DNS server must not include any DNSSEC data in a DNS response.
boolean
coredns.log.error.message
The error message
text
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
event.dataset
Event dataset
constant_keyword
event.module
Event module
constant_keyword
host.containerized
If the host is a container.
boolean
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
input.type
Input type
keyword
kubernetes.container.name
Kubernetes container name
keyword
kubernetes.labels.*
Kubernetes labels map
object
kubernetes.namespace
Kubernetes namespace
keyword
kubernetes.node.name
Kubernetes node name
keyword
kubernetes.pod.name
Kubernetes pod name
keyword
kubernetes.pod.uid
Kubernetes pod UID
keyword
kubernetes.replicaset.name
Kubernetes replicaset name
keyword
log.file.device_id
ID of the device containing the filesystem where the file resides.
keyword
log.file.fingerprint
The sha256 fingerprint identity of the file when fingerprinting is enabled.
keyword
log.file.idxhi
The high-order part of a unique identifier that is associated with a file. (Windows-only)
keyword
log.file.idxlo
The low-order part of a unique identifier that is associated with a file. (Windows-only)
keyword
log.file.inode
Inode number of the log file.
keyword
log.file.vol
The serial number of the volume that contains a file. (Windows-only)
keyword
log.offset
Log offset
long

An example event for log looks as following:

{
    "@timestamp": "2023-09-27T18:59:58.096Z",
    "agent": {
        "ephemeral_id": "bbb180b6-3756-4f5b-81d5-6e333e740796",
        "id": "86a82f91-ff66-4d28-ab7c-eb9350f317ed",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "coredns": {
        "log": {
            "buffer_size": 1232,
            "dnssec_ok": false
        }
    },
    "data_stream": {
        "dataset": "coredns.log",
        "namespace": "ep",
        "type": "logs"
    },
    "destination": {
        "bytes": 65
    },
    "dns": {
        "header_flags": [
            "RD",
            "RA"
        ],
        "id": "58521",
        "question": {
            "class": "IN",
            "name": "google.com",
            "registered_domain": "google.com",
            "top_level_domain": "com",
            "type": "A"
        },
        "response_code": "NOERROR"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "86a82f91-ff66-4d28-ab7c-eb9350f317ed",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "network"
        ],
        "created": "2023-09-27T18:59:58.096Z",
        "dataset": "coredns.log",
        "duration": 32133957.999999996,
        "ingested": "2023-09-27T18:59:59Z",
        "kind": "event",
        "original": "[INFO] 192.168.112.3:45632 - 58521 \"A IN google.com. udp 51 false 1232\" NOERROR qr,rd,ra 65 0.032133958s",
        "outcome": "success",
        "type": [
            "protocol"
        ]
    },
    "host": {
        "architecture": "aarch64",
        "containerized": false,
        "hostname": "docker-fleet-agent",
        "id": "ddbe644fa129402e9d5cf6452db1422d",
        "ip": [
            "172.31.0.7"
        ],
        "mac": [
            "02-42-AC-1F-00-07"
        ],
        "name": "docker-fleet-agent",
        "os": {
            "codename": "focal",
            "family": "debian",
            "kernel": "5.15.49-linuxkit",
            "name": "Ubuntu",
            "platform": "ubuntu",
            "type": "linux",
            "version": "20.04.6 LTS (Focal Fossa)"
        }
    },
    "input": {
        "type": "filestream"
    },
    "log": {
        "file": {
            "device_id": 141,
            "inode": 18614042,
            "path": "/tmp/service_logs/coredns.log"
        },
        "level": "info",
        "offset": 67
    },
    "network": {
        "bytes": 116,
        "iana_number": "17",
        "protocol": "dns",
        "transport": "udp"
    },
    "related": {
        "hosts": [
            "google.com"
        ],
        "ip": [
            "192.168.112.3"
        ]
    },
    "source": {
        "address": "192.168.112.3",
        "bytes": 51,
        "ip": "192.168.112.3",
        "port": 45632
    },
    "tags": [
        "preserve_original_event",
        "coredns-log"
    ]
}

Changelog

VersionDetailsKibana version(s)

0.8.0

Enhancement View pull request
ECS version updated to 8.11.0. Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.

0.7.0

Enhancement View pull request
Add global filter on data_stream.dataset to improve performance.

0.6.1

Bug fix View pull request
Add null and ignore_missing check to handle event.original field.

0.6.0

Enhancement View pull request
Update the package format_version to 3.0.0.

0.5.0

Enhancement View pull request
Adapt fields for changes in file system info

0.4.0

Enhancement View pull request
Rename ownership from obs-service-integrations to obs-infraobs-integrations

0.3.0

Enhancement View pull request
Migrate Overview dashboard visualizations to lens.

0.2.2

Bug fix View pull request
Fix reference error in Overview dashboard.

0.2.1

Enhancement View pull request
Added categories and/or subcategories.

0.2.0

Enhancement View pull request
Update ECS version to 8.5.1

0.1.0

Enhancement View pull request
Initial draft of the package

On this page