1. ISC BIND querylog format
   1. Querylog enhancements
   2. Syslog envelopes
   3. Client query event
   4. Client response event
   5. Parse error event
   6. Metrics event
2. JSON format
   1. Top-level envelope
   2. Client query event
   3. Client response event
   4. Parse error event
   5. Metrics event

ISC BIND querylog format

Querylog enhancements

DnsStream’s querylog output is based on the ISC BIND query log format, extended with a response: keyword and inline answer records for response events. Additionally metrics: for periodic metrics events, and error: to report errors such as parse errors when processing events from the Windows DNS server, are also emitted.

Querylog events are delivered as the syslog message body in both BSD syslog and RFC 5424 delivery modes.

The querylog format has two variants controlled by log-querylog-format in dnsstream.conf:

• Standard - the core BIND querylog fields only.
• Extended - standard fields plus a size, transaction ID and domain field.

Both standard and extended formats are documented for each relevant event type.

Syslog envelopes

DnsStream delivers events wrapped in a syslog envelope when log-format querylog is set. Two envelope formats are available: BSD syslog (RFC 3164) and structured syslog (RFC 5424).

The BSD syslog (RFC 3164) envelope is the older of the two formats and is supported by virtually every syslog receiver. It has no version field, uses a locale-dependent timestamp with no year or timezone, and carries the PID in bracket notation attached to the app name.

<30>Mar 23 19:40:44 WIN-4L04FD5AKGL dnsstream[8296]: <event>

RFC 5424 is the modern structured syslog format. It adds a version field, a timezone-aware ISO 8601 timestamp, a message ID field, and a structured data section. DnsStream sets both the message ID and structured data fields to the nil value -, carrying all event data in the message body.

<30>1 2000-01-01T19:00:00Z windows2025 dnsstream 6824 - - <event>

The same priority value, which defaults to <30>, is used for all DnsStream events. For reference:

This can changed in the dnsstream.conf configuration file.

Client query event

A client query event is generated when the Windows DNS Server receives an inbound query from a client. It captures the question the client asked before the server has produced a response.

Full message - with log-syslog-format rfc5424 and log-querylog-format standard set:

<30>1 2000-01-01T19:00:00Z windows2025 dnsstream 6824 - - queries: client 192.168.68.164#61776: query: telemity.com. IN A + (192.168.68.162)

Full message - with log-syslog-format rfc5424 and log-querylog-format extended set:

<30>1 2000-01-01T19:00:00Z windows2025 dnsstream 6824 - - queries: client 192.168.68.164#61776 %1085: query: telemity.com. [telemity.com.] IN A + (192.168.68.162 32b)

Full message - with log-syslog-format bsd and log-querylog-format standard set:

<30>Mar 23 19:40:44 WIN-4L04FD5AKGL dnsstream[8296]: queries: client 192.168.68.164#61750: query: telemity.com. IN A + (192.168.68.162)

Standard fields are always included, extended fields are only present when log-querylog-format extended is set.

The flags object reflects the DNS header flags present in the query. Flags are concatenated without separators. The following flags are currently included:

Client response event

A client response event is generated when the DNS server sends a response. DnsStream extends the BIND querylog format with the response code and the full answer section appended after the server IP.

Full message - with log-syslog-format rfc5424 and log-querylog-format standard set:

<30>1 2000-01-01T19:00:00Z windows2025 dnsstream 6824 - - queries: client 192.168.68.164#61776: response: www.telemity.com. IN A + (192.168.68.162) NOERROR; www.telemity.com. 600 IN CNAME telemity.com.; telemity.com. 600 IN A 20.47.114.0

Full message - with log-syslog-format rfc5424 and log-querylog-format extended set:

<30>1 2000-01-01T19:00:00Z windows2025 dnsstream 6824 - - queries: client 192.168.68.164#61776 %1085: response: www.telemity.com. [telemity.com.] IN A + (192.168.68.162 89b) NOERROR; www.telemity.com. [telemity.com.] 600 IN CNAME telemity.com.; telemity.com. [telemity.com.] 600 IN A 20.47.114.0

Full message - with log-syslog-format bsd and log-querylog-format standard set:

<30>Mar 23 19:40:44 WIN-4L04FD5AKGL dnsstream[8296]: queries: client 192.168.68.164#61776: response: www.telemity.com. IN A + (192.168.68.162) NOERROR; www.telemity.com. 600 IN CNAME telemity.com.; telemity.com. 600 IN A 20.47.114.0

Standard fields are always included, extended fields are only present when log-querylog-format extended is set.

The flags object reflects the DNS header flags present in the response. Flags are concatenated without separators. The following flags are currently included:

Each record in the answer-record field follows standard DNS presentation format: name ttl class type data. For extended querylog format, an additional domain field is present after name. All records are preceeded with ; (semicolon and space) which allows parsing using regex groupings and determining the presence of answer records easier. The example shows a two-record CNAME chain in extended format:

; www.telemity.com. [telemity.com.] 600 IN CNAME telemity.com.; telemity.com. [telemity.com.] 600 IN A 20.47.114.0

FQDNs in name and data always end with a trailing dot unless log-trailing-dot off is set.

The data field of each DNS record is always a string in DNS presentation format, i.e. what you might find in a DNS zone file in plain text format. The format is determined by rrtype, e.g..

Unknown record types are preserved as hex-encoded data and are never silently dropped. If DnsStream encounters an unfamiliar rrtype, the raw bytes are always available in data using the format \# <length> <hex-encoding>.

Parse error event

Generated when DnsStream receives an ETW event which contains a DNS packet it cannot parse. Captures the raw packet for downstream analysis and includes an error description.

Error events are delivered to the same forwarding target as DNS events, in the same querylog format. This is embedded in the same configured Syslog envelope, and can be parsed and routed by the same pipeline. It is distinguished from other events by the error: keyword in place of queries:.

Full message - with log-syslog-format rfc5424 set:

<28>1 2000-01-01T19:00:00Z windows2025 dnsstream 6824 - - error: client 192.168.68.164#54812: Read DNS message failed: Read uint16_t failed: Offset 8 + 2 is out of bounds for data of 9 bytes: \# 9 A51500200001000000

Full message - with log-syslog-format bsd set:

<28>Mar 23 19:40:44 WIN-4L04FD5AKGL dnsstream[8296]: error: client 192.168.68.164#54812: Read DNS message failed: Read uint16_t failed: Offset 8 + 2 is out of bounds for data of 9 bytes: \# 9 A51500200001000000

Metrics event

A metrics event is emitted by DnsStream at each configured log-metrics-interval.

Metrics events are delivered to the same forwarding target as DNS events, in the same querylog format. This is embedded in the same configured Syslog envelope, and can be parsed and routed by the same pipeline. It is distinguished from other events by the metrics: keyword in place of queries:.

Full message - with log-syslog-format rfc5424 set:

<30>1 2026-03-24T10:00:00Z windows2025 dnsstream 6824 - - metrics: etwReader[numberOfBuffers=16 freeBuffers=16 eventsLost=0 buffersWritten=310875 logBuffersLost=0 realTimeBuffersLost=0] forwarder[id=0 host=host1.internal port=514 state=connected bytesSent=5629 eventsSent=42 connects=1] eventQueue[eventsProcessed=42 eventsQueued=0 eventsDropped=0]

Full message - with log-syslog-format bsd set:

<30>Mar 24 10:00:00 windows2025 dnsstream[6824]: metrics: etwReader[numberOfBuffers=16 freeBuffers=16 eventsLost=0 buffersWritten=310875 logBuffersLost=0 realTimeBuffersLost=0] forwarder[id=0 host=host1.internal port=514 state=connected bytesSent=5629 eventsSent=42 connects=1] eventQueue[eventsProcessed=42 eventsQueued=0 eventsDropped=0]

Metrics fields are documented under the Field reference section in the Metrics & health documentation.

JSON format

Top-level envelope

DnsStream’s JSON output sends newline-delimited JSON objects (NDJSON) over a persistent TCP connection. Each event is a single JSON object on a single line, terminated by \n. There is no framing, no length prefix, and no enclosing array - each line is a complete, independently parseable event.

{"timestamp":"2000-01-01T19:00:00Z","host":"windows2025",...}\n

Every DnsStream JSON event shares the same top-level structure.

{
  "timestamp": "2000-01-01T19:00:00Z",
  "host":      "windows2025",
  "schema":    1,
  "type":      "client-response",
  "data":      { ... }
}

The following event types are currently defined (schema version changes when new event types are introduced):

Client query event

Generated when the Windows DNS Server service receives an inbound DNS query from a client. Captures the client’s question before the server has produced a response. Contains question section fields only - no response data is present.

{
  "timestamp": "2000-01-01T19:00:00Z",
  "host":      "windows2025",
  "schema":    1,
  "type":      "client-query",
  "data": {
    "client":  "192.168.68.164",
    "server":  "192.168.68.162",
    "port":    61776,
    "proto":   "udp",
    "size":    32,
    "txid":    1085,
    "flags": {
      "rd": true
    },
    "qname":   "www.telemity.com.",
    "qdomain": "telemity.com.",
    "qclass":  "IN",
    "qtype":   "A"
  }
}

The following data fields are included in addition to the Top-level envelope fields:

The flags object reflects the DNS header flags present in the query.

Client response event

Generated when the Windows DNS Server service sends a DNS response to a client. Extends the client query fields with the server’s answer - the response code and the full answer, authority, and additional sections.

{
  "timestamp": "2000-01-01T19:00:00Z",
  "host":      "windows2025",
  "schema":    1,
  "type":      "client-response",
  "data": {
    "client":  "192.168.68.164",
    "server":  "192.168.68.162",
    "port":    61776,
    "proto":   "udp",
    "size":    89,
    "txid":    1085,
    "flags": {
      "rd": true,
      "ra": true,
      "aa": false,
      "tc": false
    },
    "qname":   "www.telemity.com.",
    "qdomain": "telemity.com.",
    "qclass":  "IN",
    "qtype":   "A",
    "rcode":   "NOERROR",
    "answers": [
      {
        "name":    "www.telemity.com.",
        "ttl":     600,
        "rrclass": "IN",
        "rrtype":  "CNAME",
        "data":    "telemity.com."
      },
      {
        "name":    "telemity.com.",
        "ttl":     600,
        "rrclass": "IN",
        "rrtype":  "A",
        "data":    "20.47.114.0"
      }
    ],
    "authority":  [],
    "additional": []
  }
}

The following data fields are included in addition to the Top-level envelope fields:

The flags object reflects the DNS header flags present in the response.

DNS records in answers, authority, and additional are objects which define one complete DNS record:

Trailing dots on domain names are present unless log-trailing-dot off is set in dnsstream.conf, in which case they are omitted from all FQDN values throughout the event.

The data field of each DNS record is always a string in DNS presentation format, i.e. what you might find in a DNS zone file in plain text format. The format is determined by rrtype, e.g..

Unknown record types are preserved as hex-encoded data and are never silently dropped. If DnsStream encounters an unfamiliar rrtype, the raw bytes are always available in data using the format \# <length> <hex-encoding>.

Parse error event

Generated when DnsStream receives an ETW event which contains a DNS packet it cannot parse. Captures the raw packet for downstream analysis and includes an error description.

{
  "timestamp": "2000-01-01T19:00:00Z",
  "host":      "windows2025",
  "schema":    1,
  "type":      "parse-error",
  "data": {
    "client":  "192.168.68.164",
    "server":  "192.168.68.162",
    "port":    54812,
    "size":    9,
    "error":   "Read DNS message failed: Read uint16_t failed: Offset 8 + 2 is out of bounds for data of 9 bytes",
    "packet":  "0a1b2c3d4e5f0a1b2c"
  }
}

The following data fields are included in addition to the Top-level envelope fields:

Metrics event

Generated at each configured log-metrics-interval. The metrics event uses the same top-level envelope as other events, travels through the same forwarding pipeline, and is distinguished from other events by "type": "metrics". This allows SIEM-side dashboards and health alerts to be driven by the same data stream as DNS telemetry, with no separate monitoring channel required.

{
  "timestamp": "2026-03-24T10:00:00Z",
  "host":      "windows2025",
  "schema":    1,
  "type":      "metrics",
  "data": {
    "etwReader": {
      "numberOfBuffers":      16,
      "freeBuffers":          16,
      "eventsLost":           0,
      "buffersWritten":       310875,
      "logBuffersLost":       0,
      "realTimeBuffersLost":  0
    },
    "forwarders": [
      {
        "id":         0,
        "host":       "host1.internal",
        "port":       514,
        "state":      "connected",
        "bytesSent":  5629,
        "eventsSent": 42,
        "connects":   1
      }
    ],
    "eventQueue": {
      "eventsProcessed": 42,
      "eventsQueued":    0,
      "eventsDropped":   0
    }
  }
}

Metrics fields, which are included in addition to the Top-level envelope fields, are documented under the Field reference section in the Metrics & health documentation.