use-case-19.yml

# This configuration sets up DNS traffic monitoring through DNStap on port 6000;
# applies tranformations on dnstap collector and the console logger

# If turned on, debug messages are printed in the standard output
global:
  trace:
    verbose: true

pipelines:
  - name: tap
    dnstap:
      listen-ip: 0.0.0.0
      listen-port: 6000
    transforms:
      normalize:
        qname-lowercase: true
      latency:
        measure-latency: true
        queries-timeout: 2
    routing-policy:
      forward: [ console ]

  - name: console
    stdout:
      mode: text
      text-format: timestamp-rfc3339ns identity operation rcode qname qtype latency suspicious-score
    transforms:
      filtering:
        log-queries : false
      suspicious:
        threshold-qname-len: 4