Configuration Examples

Get started quickly with these ready-to-use configuration examples covering common use cases and deployment scenarios.

Pipelines & Filtering

Enrich and filter DNS messages at the pipeline level.

• Advanced tagging & metadata
• Filter slow responses & errors
• Filter by Response IP (0.0.0.0)
• Detect newly observed domains

Ingestion & Routing

Forward, relay, and aggregate various streaming protocols.

• UNIX Socket to TLS Stream Relayer
• Zero-Decoded DNStap Relay
• Multi-Stream Aggregator to File
• Syslog over TLS Logger

Format Conversions

Output DNS traffic into multiple formats for downstream processing.

• Custom text output format
• CSV style output format
• Dig-style template (Jinja2)
• Standard JSON lines output
• Flat JSON for indexing engines

Transformations & Enrichment

Perform inline edits, hashing, and lookups on query streams.

• User Privacy / IP Anonymization
• Downsampling & domain whitelists
• Domain name lowercasing
• GeoIP enrichment (country, AS)
• Deduplicate repetitive queries

File & PCAP Ingestion

Ingest, replay, and capture traffic via files.

• Save stream to raw DNStap file
• Read raw DNStap files as input
• Dual file logger (Text & PCAP)
• Offline PCAP parser to JSON

PowerDNS Integration

Ingest and route native PowerDNS logging streams.

• Capture multiple PowerDNS streams
• PowerDNS Protobuf to DNStap

Observability & Monitoring

Expose metrics and stream logs to monitoring stacks.

• Prometheus metrics & Grafana
• Loki log streaming & Grafana
• Evicted queries count metric

Security & Advanced Protocols

Detect anomalies and ingest proprietary capture protocols.

• Suspicious DNS traffic detector
• Mikrotik TZSP stream to JSON
• OpenTelemetry pipeline tracing