# CONFIGURED BY ANSIBLE # (now as a simple grep exclude in flb_suricata.conf) #[STREAM_TASK] # name flow_no_dns # exec CREATE STREAM flowfix WITH (tag='source.flowfix') AS SELECT * from STREAM:suricata WHERE NOT dest_port = 53;