type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [".gz$"]
tags: {{.tags}}

processors:
  - rename:
      fields:
        - {from: message, to: event.original}
  - decode_json_fields:
      fields: [event.original]
      target: zeek.dns
  - script:
      lang: javascript
      id: zeek_dns_flags
      source: >
        var net = require("net");

        function addDnsHeaderFlags(evt) {
            var flag = evt.Get("zeek.dns.AA");
            if (flag === true) {
                evt.AppendTo("dns.header_flags", "AA");
            }
            flag = evt.Get("zeek.dns.TC");
            if (flag === true) {
                evt.AppendTo("dns.header_flags", "TC");
            }
            flag = evt.Get("zeek.dns.RD");
            if (flag === true) {
                evt.AppendTo("dns.header_flags", "RD");
            }
            flag = evt.Get("zeek.dns.RA");
            if (flag === true) {
                evt.AppendTo("dns.header_flags", "RA");
            }
        }

        function addDnsQuestionClass(evt) {
            var qclass = evt.Get("zeek.dns.qclass");
            if (!qclass) {
                return;
            }
            switch (qclass) {
                case 1:
                    qclass = "IN";
                    break;
                case 3:
                    qclass = "CH";
                    break;
                case 4:
                    qclass = "HS";
                    break;
                case 254:
                    qclass = "NONE";
                    break;
                case 255:
                    qclass = "ANY";
                    break;
            }
            evt.Put("dns.question.class", qclass);
        }

        function addDnsAnswers(evt) {
            var answers = evt.Get("zeek.dns.answers");
            var ttls = evt.Get("zeek.dns.TTLs");
            if (!answers || !ttls || answers.length != ttls.length) {
                return;
            }

            var resolvedIps = [];
            var answersObjs = [];
            for (var i = 0; i < answers.length; i++) {
                var answer = answers[i];
                answersObjs.push({
                    data: answer,
                    ttl: ttls[i],
                })
                if (net.isIP(answer)) {
                    resolvedIps.push(answer);
                }
            }
            evt.Put("dns.answers", answersObjs);
            if (resolvedIps.length > 0) {
                evt.Put("dns.resolved_ip", resolvedIps);
            }
        }

        function setDnsType(evt) {
            var response_code = evt.Get("zeek.dns.rcode_name");
            if (response_code) {
              evt.Put("dns.type", "answer");
            } else {
              evt.Put("dns.type", "query");
            }
        }

        function addEventDuration(evt) {
            var rttSec = evt.Get("zeek.dns.rtt");
            if (!rttSec) {
                return;
            }
            evt.Put("event.duration", rttSec * 1000000000);
        }

        function process(evt) {
            addDnsHeaderFlags(evt);
            addDnsQuestionClass(evt);
            addDnsAnswers(evt);
            setDnsType(evt);
            addEventDuration(evt);
        }
  - convert:
      ignore_missing: true
      ignore_failure: true
      mode: rename
      fields:
        - {from: zeek.dns.id.orig_h, to: source.address}
        - {from: zeek.dns.id.orig_p, to: source.port, type: long}
        - {from: zeek.dns.id.resp_h, to: destination.address}
        - {from: zeek.dns.id.resp_p, to: destination.port, type: long}
        - {from: zeek.dns.uid, to: zeek.session_id}
        - {from: zeek.dns.proto, to: network.transport}
  - convert:
      ignore_missing: true
      ignore_failure: true
      mode: copy
      fields:
        - {from: source.address, to: source.ip, type: ip}
        - {from: destination.address, to: destination.ip, type: ip}
        - {from: zeek.session_id, to: event.id}
        - {from: '@timestamp', to: event.created}
        - {from: zeek.dns.trans_id, to: dns.id}
        - {from: zeek.dns.query, to: dns.question.name}
        - {from: zeek.dns.qtype_name, to: dns.question.type}
        - {from: zeek.dns.rcode_name, to: dns.response_code}
  - registered_domain:
      ignore_missing: true
      ignore_failure: true
      field: dns.question.name
      target_field: dns.question.registered_domain
{{ if .community_id }}
  - community_id: ~
{{ end }}
  - timestamp:
      ignore_missing: true
      field: zeek.dns.ts
      layouts:
        - UNIX
  - drop_fields:
      ignore_missing: true
      fields:
        - zeek.dns.Z
        - zeek.dns.auth
        - zeek.dns.addl
        - zeek.dns.ts
