Would it be possible to make this plugin configurable to look at a field in the message other than source?
Assuming "dns_resolver_run_before_extractors=false" is set, the extractors would run first and create many other fields in the messages. It would be great to be able to configure this plugin to look at one or more fields created by the extractors, which contain IP addresses, and do an RDNS on those. This plugin could then be used to do RDNS on IPs in firewall log messages, rather than just on the IP of the device sending the message to Graylog.
I unfortunately cannot contribute to this as I don't have much in the way of Java skills, but it would be really cool if it could be done.
Would it be possible to make this plugin configurable to look at a field in the message other than source?
Assuming "dns_resolver_run_before_extractors=false" is set, the extractors would run first and create many other fields in the messages. It would be great to be able to configure this plugin to look at one or more fields created by the extractors, which contain IP addresses, and do an RDNS on those. This plugin could then be used to do RDNS on IPs in firewall log messages, rather than just on the IP of the device sending the message to Graylog.
I unfortunately cannot contribute to this as I don't have much in the way of Java skills, but it would be really cool if it could be done.