# Append variable to alert msg

**URL:** https://forum.suricata.io/t/append-variable-to-alert-msg/5917
**Category:** Help
**Created:** [August 7, 2025, 3:23am UTC](https://forum.suricata.io/t/append-variable-to-alert-msg/5917 "2025-08-07T03:23:17Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![cs.lev](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/cs.lev/32/2596_2.png) [@cs.lev](https://forum.suricata.io/u/cs.lev)
#### Post date: [August 7, 2025, 3:23am UTC](https://forum.suricata.io/t/append-variable-to-alert-msg/5917/1 "2025-08-07T03:23:17Z")

</div>

Hi,

I am playing around with Suricata v8.0 and I want to capture all DNS NXDOMAIN responses and see what the requested domains were that ended up having NXDOMAIN responses. I managed to create a rule that work perfectly, however, I want to extend my `msg` to show the actual queried domain - although my question basically generalizes to the question how to append, if possible, any variable to the `msg`.  
The problem is that vetting the `fast.log` is easy, but the `eve.log` is getting huge quite fast and difficult to use for my simple use case. So, i have this rule:

```auto
# DNS NXDOMAIN response
alert dns any 53 -> any any \
    (msg:"NXDOMAIN Response Detected"; \
    flow:established,to_client; \
    dns.rcode:NXDOMAIN; \
    classtype:protocol-command-decode; \
    metadata: prio medium ; \
    sid:1000005; \
    rev:7;)

```

This creates the alerts in the `fast.log` and also logs in `eve.log`. In the latter I can see all details based on the logging settings in `suricata.yml` including the requested domain. But I want to append this to my log msg. Is it possible?

I tried many different ways, but neither were resolved to the actual value, like using $dns.rrname, etc.

I bet it’s not possible, but wanted to give a try to ask, maybe I am just missing something. And I also want to understand why it is not possible, what the rationale is, because I am sure there is 🙂

---

<div class="post-metadata">

### Author: ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)
#### Post date: [August 23, 2025, 9:00pm UTC](https://forum.suricata.io/t/append-variable-to-alert-msg/5917/2 "2025-08-23T21:00:54Z")

</div>

I think the best answer is eve.json processor (some have been shown in past Suricon)

See [GitHub - satta/awesome-suricata: A curated list of awesome things related to Suricata](https://github.com/satta/awesome-suricata?tab=readme-ov-file#output-tools)