Dns_query does not output resolved IP

Telegraf
1

Hi I have followed the instructions like so:

[[inputs.dns_query]]
  servers = ["8.8.8.8"]
  network = "udp"
  domains = ["sec-api.foxac236.net"]
  port = 53
  include_fields = ["first_ip"]

But I get no first_ip as output (same happens with all_ips):

image
image976×1214 71.8 KB

I query all the fields for dns_query and I get nothing:

SELECT * FROM dns_query WHERE server = '8.8.8.8' AND domain = 'sec-api.foxac236.net' AND host = '95135e7' AND time > now() - 1h

My telegraf is 1.26.2 and based on dns_query and feature added, my code should be working. Can anyone help please?

2

first_ip produces a field called ip (e.g. fields["ip"] = ip) with the first IP

all_ips produce fields called ip_# (e.g. fields["ip_"+strconv.Itoa(i)] = ip) with each IP from each record.

Try running with --test and provide the results.

3

thank you for answering, here is the result:

^Ctelegraf@SCZ-Harm-02:/$ telegraf --config /etc/telegraf/telegraf.conf --test | grep sec      
2023-05-05T00:51:03Z I! Loading config: /etc/telegraf/telegraf.conf
> dns_query,domain=sec-api.foxac236.net,host=SCZ-Harm-02,rcode=NOERROR,record_type=NS,result=success,server=8.8.8.8 query_time_ms=109.369736,rcode_value=0i,result_code=0i 1683247864000000000

No IP provided :frowning:

4

record_type=NS

It only appears to extract the IP for A and AAAA records

5

thanks i will add record_type = "A" to my dns_query and see the results