matching with arrays

[drenton1]

I'm looking to filter dnstap messages where the response ip address is 0.0.0.0. Consider the below dnstap json. How would I create a pipeline with dnsmessage > matching > include to filter for the 0.0.0.0 ip. I tried the following without success.

pipelines:
  - name: filter-messages
    dnsmessage:
      matching:
        include:
          dns.resource-records.an.0.rdata: "0.0.0.0"

{
  "dns": {
    "resource-records": {
      "an": [
        {
          "name": "test.example.com",
          "rdatatype": "A",
          "class": "IN",
          "ttl": 86400,
          "rdata": "0.0.0.0"
        }
      ],
      "ns": [],
      "ar": []
    }
  }
}

Thanks

[dmachard]

Could you try to escape the dot ?
dns.resource-records.an.0.rdata: "0\\.0\\.0\\.0"

[dmachard]

Can you share your full config ?
I will try to reproduce in my side

[drenton1]

global:
  trace:
    verbose: true

pipelines:
  - name: tap_unix
    dnstap:
      sock-path: /var/run/named/dnstap.sock
    routing-policy:
      forward: [ filter-messages ]
      
  - name: filter-messages
    dnsmessage:
      matching:
        include:
          dnstap.operation: "CLIENT_RESPONSE"
          dns.qtype: "A"
          dns.rcode: "NOERROR"
          dns.resource-records.an.0.rdata: "0.0.0.0"
    routing-policy:
      forward: [console]

  - name: console
    stdout:
      mode: flat-json

and the console flat-json

{"dns.flags.aa":false,"dns.flags.ad":false,"dns.flags.cd":false,"dns.flags.qr":true,"dns.flags.ra":true,"dns.flags.rd":true,"dns.flags.tc":false,"dns.id":1356,"dns.length":49,"dns.malformed-packet":false,"dns.opcode":0,"dns.qclass":"IN","dns.qname":"www.example.com","dns.qtype":"A","dns.questions-count":1,"dns.rcode":"NOERROR","dns.resource-records.an.0.class":"IN","dns.resource-records.an.0.name":"www.example.com","dns.resource-records.an.0.rdata":"0.0.0.0","dns.resource-records.an.0.rdatatype":"A","dns.resource-records.an.0.ttl":90,"dns.resource-records.ar":"-","dns.resource-records.ns":"-","dnstap.extra":"-","dnstap.identity":"example.com","dnstap.latency":0,"dnstap.operation":"CLIENT_RESPONSE","dnstap.peer-name":"@","dnstap.policy-action":"NXDOMAIN","dnstap.policy-match":"QNAME","dnstap.policy-rule":"-","dnstap.policy-type":"-","dnstap.policy-value":"-","dnstap.query-zone":"-","dnstap.timestamp-rfc3339ns":"2024-09-04T14:21:18.092484094Z","dnstap.version":"BIND 9","edns.dnssec-ok":0,"edns.options":"-","edns.rcode":0,"edns.udp-size":0,"edns.version":0,"network.family":"IPv4","network.ip-defragmented":false,"network.protocol":"UDP","network.query-ip":"192.168.1.2","network.query-port":"51179","network.response-ip":"192.168.1.1","network.response-port":"-","network.tcp-reassembled":false}

Thanks!

[dmachard]

Thanks for sharing your config.
I've reproduced the issue on my side. Could you please open an issue?

[drenton1]

Done. Thanks.

#799