added comment: filebeat 6.6.0 above: change input_type to type

etc/filebeat/filebeat.yml

@@ -3,6 +3,8 @@ filebeat:
    -
      paths:
         - /var/log/pihole.log
+     
+     # filebeat 6.6.0 above: change input_type to type
      input_type: log
  registry_file: /var/lib/filebeat/registry
  

logstash/patterns/dns

+HOSTNAMEPTR \b(?:[\._0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[\._0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
+NODATA NODATA-[[:word:]]+
+SRV _+.+\S
+FQDN \b(?:[\w-][\w-]{0,62})(?:\.(?:[\w-][\w-]{0,62}))*(\.?|\b)
+DNSMASQPREFIX %{SYSLOGTIMESTAMP:date} %{SYSLOGPROG}: %{INT:logrow} %{IP:source_host}\/%{POSINT:source_port}
\ No newline at end of file