grok

logstash/conf.d/20-dns-syslog.conf

@@ -73,6 +73,12 @@ filter {
 
 # to do cached and cached reverse
 
+      else if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
+        mutate {
+          add_tag => [ "cached NXDOMAIN" ]
+        }
+      }
+
       else if [NODATA-IPv4] {
         mutate {
           add_tag => [ "NODATA" ]
@@ -157,11 +163,6 @@ filter {
         }
       }
 
-      else if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
-        mutate {
-          add_tag => [ "cached NXDOMAIN" ]
-        }
-      }