---
title: "Filter DNS logs"
description: "Suppress low-value Calico Enterprise DNS log entries with Fluentd filters configured through a ConfigMap in the operator namespace."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns/filtering-dns"
---

# Filter DNS logs

Calico Enterprise supports filtering out DNS logs based on user provided configuration. Use filtering to suppress logs of low significance.

## Configure DNS filtering

DNS log filtering is configured through a ConfigMap in the `tigera-operator` namespace.

To enable DNS log filtering, follow these steps:

1. Create a `filters` directory with a file named `dns` with the contents of your desired filter using [Filter configuration files](#filter-configuration-files). If you are also adding [flow filters](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/filtering.md) also add the `flow` file to the directory.
2. Create the `fluentd-filters` ConfigMap in the `tigera-operator` namespace with the following command.
   ```bash
   kubectl create configmap fluentd-filters -n tigera-operator --from-file=filters
   ```

## Filter configuration files

The filters defined by the ConfigMap are inserted into the fluentd configuration file. The [upstream fluentd documentation](https://docs.fluentd.org/filter/grep) describes how to write fluentd filters. The [DNS log schema](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns/dns-logs.md) can be referred to for the specification of the various fields you can filter based on. Remember to ensure that the config file is properly indented in the ConfigMap.

## Example 1: filter out cluster-internal lookups

This example filters out lookups for domain names ending with ".cluster.local". More logs could be filtered by adjusting the regular expression "pattern", or by adding additional `exclude` blocks.

```text
<filter dns>
  @type grep
  <exclude>
    key qname
    pattern /\.cluster\.local$/
  </exclude>
</filter>
```

## Example 2: keep logs only for particular domain names

This example will filter out all logs *except* those for domain names ending `.co.uk`.

```text
<filter dns>
  @type grep
  <regexp>
      key qname
      pattern /\.co\.uk$/
  </regexp>
</filter>
```