Wylde780 dnssec

[wylde780]

Adds DNSSEC support ( sorry i'm new to git and contributing )

Adds 2 fields ( secured, validation_string) but discards validation_string immediately after the match. Add DNCSEC tag to confirm the rule matches. Add 1 visualization and adds it to the bottom row of the dashboard.

[nin9s]

didnt need dnssec support in piholes logs because I'm sending everything from pihole to 127.0.0.1 unbound who is doing dnssec. But I think many folks might use dnssec directly on pihole so this seems to be a nice addon.
Do you agree to rename the dnssec version of elk-hole - vis_and_dash.ndjson so one can decide to use with or without dnssec support. If one does not use dnssec at all, this visualization will always be empty.
tagging logic in 20-dns-syslog.conf can be merged under the same name imo

btw: show me a little screenshot :)

thanks

[wylde780]

Yes i agree to renaming the .ndjson but i do not know how to make that change without closing this and opening another :( The ndjson file you created will still need to be modified to include the new field of 'secured'

Nothing fancy but I'm just trying to get my feet wet. I clearly need to do some reading on 'how to git'.

Thanks for the feedback

[nin9s]

dont worry, this is also my first project where I just learn github and its mechanics.

The ndjson file you created will still need to be modified to include the new field of 'secured'

are you sure? The fields gets created with your edited dns-syslog.conf file but it should not hurt if I dont use one (or some) fields later in the dashboard or visualizations - correct my if I'm wrong

[wylde780]

I agree that the field will be added with the edits the 20-dns-syslog.conf file, but the field will not be searchable or at least the field will display a triangle warning. However that would be resolved if they import the new .ndjson file.

I can close this and create a new commit that will include a new .ndjson and edits to 20-dns-syslog.conf

[nin9s]

The ndjsons are not for searchability and stuff, they are only for visualizations as far as I know. Or did
I miss something important while elastic switched to ndjson instead of json files.
I think we need to edit the index template in order to make it searchable -> we definetely need to do this, almost forget that!

https://github.com/nin9s/elk-hole/blob/master/json/logstash-syslog-dns-index.template_ELK7.x.json

are you familiar on editing index templates?

[nin9s]

@wylde780 any thoughts?