dnstap.conf

trace:
  # log file path or null to print to stdout
  file: null
  # enable verbose mode
  verbose: false

# rest api
web-api:
  # enable or disable
  enable: true
  # web api key
  api-key: changeme
  # basicauth login
  login: admin
  # basicauth password
  password: changeme
  # listening address ipv4 0.0.0.0 or ipv6 [::]
  local-address: 0.0.0.0
  # listing on port
  local-port: 8080

# geoip support, can be used to get the country, and city
# according to the source ip in the dnstap message
geoip:
  # enable or disable
  enable: false
  # city database path in binary format
  city-database: null
  # represent country in iso mode
  country-iso: false
    
# dnstap receiver statistics
statistics:
  # qname lowercase
  qname-lowercase: true
  # default number of items to return in tables
  max-items: 10
  # default counters to return from api /counters
  default-counters:
   - clients
   - domains
   - query
   - response
   - qps
   - response/noerror
   - response/nxdomain
  # default top domain to return from api /tables
  default-top:
   - noerror/query
   - nxdomain/response

# read and decode dnstap messages from different sources
input:
  # read dnstap messages from tcp socket
  tcp-socket:
    # enable or disable
    enable: true
    # listening address ipv4 0.0.0.0 or ipv6 [::]
    local-address: 0.0.0.0
    # listing on port
    local-port: 6000
    # access control list
    access-control-list: 
     - 0.0.0.0/0
    # enable tls on socket
    tls-support: false
    # provide certificate server path
    tls-server-cert: null
    # provide certificate key path
    tls-server-key: null
    
  # read dnstap messages fom unix socket 
  unix-socket:
    # enable or disable
    enable: false
    # socket path
    path: null
    
  # sniff dns messages from network interface 
  sniffer:
    # enable or disable
    enable: false
    # interface name to sniff
    eth-name: null
    # ip interface to sniff
    eth-ip: [ ]
    # dnstap identity
    dnstap-identity: sniffer
    # sniff on the list of dns port
    dns-port: [ 53 ]
    # incoming dns client queries
    client-query-support: true
    # outgoing dns client responses
    client-response-support: true
    # outgoing dns resolver queries
    resolver-query-support: true
    # incoming dns client responses
    resolver-response-support: true
    # forward queries
    forwarder-query-support: true
    # forward responses
    forwarder-response-support: true
    
  # tcp client
  tcp-client:
    # enable or disable
    enable: false
    # retry interval in seconds to connect
    retry: 1
    # remote dns server address
    remote-address: null
    # remote dns server port
    remote-port: null
    
# filtering feature on input, can be useful to ignore 
# some dnstap messages
filter: 
  # qname filtering feature with regex support
  qname-regex: null
  # dnstap identify filtering feature with regex support
  dnstap-identities: null

# forward decoded messages to ?
output:
  # forward to stdout, default output
  stdout:
    # enable or disable
    enable: true
    # format available text|json|yaml
    format: text
    
  # forward to log file
  file:
    # enable or disable
    enable: false
    # format available text|json|yaml
    format: text
    # log file path or null to print to stdout  
    file: /var/log/dnstap.log
    # max size for log file
    file-max-size: 10M
    # number of max log files
    file-count: 10
    
  # print metrics to stdout
  metrics:
    # enable or disable
    enable: false
    # print every N seconds
    interval: 300
    # cumulative statistics, without clearing them after printing
    cumulative: true
    # log file path or null to print to stdout
    file: null
    # max size for log file
    file-max-size: 10M
    # number of max log files
    file-count: 10
    
  # forward to remote tcp destination
  tcp-socket:
    # enable or disable
    enable: false
    # format available text|json|yaml
    format: text
    # delimiter
    delimiter: "\n"
    # retry interval in seconds to connect
    retry: 5
    # remote ipv4 or ipv6 address
    remote-address: null
    # remote tcp port
    remote-port: null
    
  # forward to syslog server
  syslog:
    # enable or disable
    enable: false
    # syslog over tcp or udp
    transport: udp
    # format available text|json
    format: text
    # retry interval in seconds to connect
    retry: 5
    # remote ipv4 or ipv6 address of the syslog server
    remote-address: null
    # remote port of the syslog server
    remote-port: null
    
  # forward to another remote dnstap receiver
  dnstap:
    # enable or disable
    enable: false
    # retry interval in seconds to connect
    retry: 1
    # remote ipv4 or ipv6 address of the remote dnstap receiver
    remote-address: null
    # remote port of the remote dnstap receiver
    remote-port: null
    # dnstap identity
    dnstap-identity: dnstap-receiver

  # forward to a Kafka topic
  kafka:
    # enable or disable
    enable: false
    # format available text|json|yaml
    format: json
    # configuration object to pass to librdkafka
    rdkafka-config:
      "bootstrap.servers": null
      "security.protocol": null
      "sasl.mechanism": null
      "sasl.username": null
      "sasl.password": null
    # Kafka topic to forward messages to
    topic: null

  # forward to a RabbitMQ queue
  rabbitmq:
    # enable or disable
    enable: false
    # format available text|json|yaml
    format: json
    # connection configuration
    connection:
      username: null
      password: null
      host: 127.0.0.1
      port: 5672
    # Queue to forward messages to
    queue:
      queue: null
      passive: false
      durable: true
      exclusive: false
      auto_delete: false
    # Exchange, default ''
    exchange: ""
    # Routing key, default = queue
    routing-key: null
    # Retries to connect/publish
    retry-count: 2
    # Retry delay seconds
    retry-delay: 0.5

  # forward to postgresql server
  pgsql:
    # enable or disable
    enable: false
    # retry interval in seconds to connect
    retry: 1
    # dsn := postgres://user@host:port/database
    # To explicitly write passwd in dsn is not recommended though possible.
    # Instead use passfile below.
    dsn: postgres://postgres@localhost:5432/postgres
    # passfile := /path/to/.pgpass
    # https://www.postgresql.org/docs/12/libpq-connect.html#LIBPQ-CONNECT-PASSFILE
    passfile: ~/.pgpass
    # min_size: minimum number of connections in the pool
    min_size: 5
    # max_size: maximum number of connections in the pool
    max_size: 10
    # busy_wait: wait this amount of seconds in the busy loop to write to PostgreSQL.
    busy_wait: 1.0
    # timeout: wait this amount of seconds to re-create the connection pool to PostgreSQL after it failed.
    timeout: 60
    # filename including user defined functions
    userfuncfile: null

  elasticsearch:
    # enable or disable
    enable: false
    # elasticsearch url
    url: null