Can anyone confirm if DNS debug logging needs to be enabled manually before this will work correctly?
From the TA-DNS inputs.conf
[monitor://C:\Windows\System32\Dns\dns.log]
sourcetype=MSAD:NT6:DNS
disabled=false
index=msad
Thank you!
Yes, you need to enable DNS debug logging. See http://technet.microsoft.com/en-us/library/cc759581(v=ws.10).aspx for details on how to do this.