Outputs

How the dnsmonster output dispatcher works, the five output types, the supported formats, and every available backend module.

dnsmonster follows a pipeline architecture for each individual packet. After capture and filtering, each processed packet arrives at the output dispatcher, which sends a copy to every output module that has been configured to produce output.

If you specify stdoutOutputType=1 and --fileOutputType=1 --fileOutputPath=/dev/stdout, you will see each processed record twice in your stdout — once from the stdout module, once from the file module pointing at the same place.

Each output has its own configuration section. Running dnsmonster --help shows them with an _output suffix.

Output types

The most important parameter for every output is its type. All outputs share the same five values:

Output types do not nullify input filters — they are applied after capture and the early packet filters. See filters and masks for the full order in which filters are applied.

Beyond Type, each module may need additional parameters. Those are documented per module.

Available modules

Output formats

dnsmonster supports several output formats.

json

The standard JSON output:

{"Timestamp":"2020-08-08T00:19:42.567768Z","DNS":{"Id":54443,"Response":true,"Opcode":0,"Authoritative":false,"Truncated":false,"RecursionDesired":true,"RecursionAvailable":true,"Zero":false,"AuthenticatedData":false,"CheckingDisabled":false,"Rcode":0,"Question":[{"Name":"imap.gmail.com.","Qtype":1,"Qclass":1}],"Answer":[{"Hdr":{"Name":"imap.gmail.com.","Rrtype":1,"Class":1,"Ttl":242,"Rdlength":4},"A":"172.217.194.108"},{"Hdr":{"Name":"imap.gmail.com.","Rrtype":1,"Class":1,"Ttl":242,"Rdlength":4},"A":"172.217.194.109"}],"Ns":null,"Extra":null},"IPVersion":4,"SrcIP":"1.1.1.1","DstIP":"2.2.2.2","Protocol":"udp","PacketLength":64}

csv

Fields and headers are not customisable. For a custom layout, use gotemplate.

Year,Month,Day,Hour,Minute,Second,Ns,Server,IpVersion,SrcIP,DstIP,Protocol,Qr,OpCode,Class,Type,ResponseCode,Question,Size,Edns0Present,DoBit,Id
2020,8,8,0,19,42,567768000,default,4,2050551041,2050598324,17,1,0,1,1,0,imap.gmail.com.,64,0,0,54443

csv_no_headers

Identical to csv, without the header line.

gotemplate

A customisable template for your own formatting. Using the same packet as above:

dnsmonster --pcapFile input.pcap --stdoutOutputType=1 --stdoutOutputFormat=gotemplate --stdoutOutputGoTemplate="timestamp=\"{{.Timestamp}}\" id={{.DNS.Id}} question={{(index .DNS.Question 0).Name}}"

timestamp="2020-08-08 00:19:42.567735 +0000 UTC" id=54443 question=imap.gmail.com.

See the text/template documentation for everything the template language supports.

In this section

• ClickHouse Configure the dnsmonster ClickHouse output, set retention with TTL, use SAMPLE queries and run the bundled Grafana dashboard.
• Apache Kafka Ship dnsmonster records to Kafka with compression, TLS and multiple brokers — the recommended output for enterprise deployments.
• Elasticsearch and OpenSearch Send dnsmonster records to Elasticsearch 7.x, OpenSearch or Opendistro.
• Splunk HEC Push dnsmonster JSON into a Splunk index through the HTTP Event Collector, with multiple endpoints for load balancing.
• Microsoft Sentinel Send dnsmonster logs to Microsoft Sentinel or any Log Analytics workspace.
• PostgreSQL Experimental dnsmonster output for PostgreSQL and compatible engines such as CockroachDB.
• InfluxDB Configure the dnsmonster InfluxDB output — server, token, bucket, org, workers and batch size.
• VictoriaLogs Send dnsmonster logs to a VictoriaLogs JSON line insert endpoint.
• Zinc Search Send dnsmonster logs to a ZincSearch bulk endpoint.
• Apache Parquet Write dnsmonster records to Parquet files on disk.
• Stdout, file and syslog Plain outputs for SIEM agents — stdout, a log file, or a syslog endpoint, with JSON, OCSF, CSV and Go template formats.
• Metrics Monitor a running dnsmonster instance with stderr, statsd or prometheus metrics.