dns.yml

---

# configuration file of single log pattern

name: dns

# if true this pattern is enabled and it will be used
enabled: false

# path where store the log. If the path doesn't exist will be created
path: /tmp/dns.log

# remove log file before use it
remove_file: true

# event per seconds for this pattern, default 1
# if specified this value overwrite the common one
eps: 2000

# eps correction percentage, default 1.2
correction: 1.12

# time period in seconds. This value says how many seconds of logs will be generate
time_period: 1

# generator types:
# - raw: it gets raw logs from examples and uses them to make logging
# - template: it uses a template to generate logs 
#           (https://docs.python.org/3/library/string.html#custom-string-formatting)

generator_type: template

# logs of example, to use as documentation or use for random generator in raw generator type
examples:
  - "Feb  5 09:12:11 ns1 named[80090]: client 192.168.10.12#3261: query: www.server.example IN A"

# log template to random generator
# for replace the timestamp use this table: 
# https://docs.python.org/2/library/datetime.html#strftime-and-strptime-behavior
# You can use more than one template
template: 
  - '{:%b  %d %H:%M:%S} ns1 named[{pid}]: client {ipaddress}#{port}: query: {query} IN {dns_type}'

fields:
  ipaddress: func_randip
  pid: func_randint 0 100000
  port: func_randint 1025 65535
  query:
    - www.server.example
    - google.com
    - facebook.com
    - alexa.com
    - repubblica.it
    - ilfatto.it
    - test.com
  dns_type:
    - A
    - CN
    - PTR