enrich bro dns logs

[philhagen]

for any [answer] that is an IP, add to [ips] and grok to [answer_ip] for enrichment? passivedns makes this easy since each answer is its own log entry... may need to split the bro entry to multiple events for parallel handling?

[philhagen]

other option is to use ruby code, but concerned about performance impact

[SMAPPER]

I've done a few things like this by invoking ruby and the performance has been good. I permanently leave these two config files enabled so I can easily monitor time impacts on logs:

https://github.com/SMAPPER/Logstash-Configs/tree/master/configfiles-OPTIONAL

[philhagen]

this is handled via other means now. will continue to consider a "time in flight" metadata calculation though