Update 20-dns-syslog.conf

logstash/conf.d/20-dns-syslog.conf

@@ -131,6 +131,14 @@ filter {
         }
       }
 
+     
+
+      else if [message] =~ "cached" and [message] =~ "CNAME" {
+        mutate {
+          add_tag => [ "cached domain to ip cname" ]
+        }
+      }
+
 	  else if [domain_request] and [message] =~ "cached" {
         mutate {
           add_tag => [ "cached domain to ip" ]
@@ -140,12 +148,6 @@ filter {
         }
       }
 
-      else if [message] =~ "cached" and [message] =~ "CNAME" {
-        mutate {
-          add_tag => [ "cached domain to ip cname" ]
-        }
-      }
-
       else if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
         mutate {
           add_tag => [ "cached NXDOMAIN" ]