Same issue here...
Btw, don't use .* in the beginning of this regex, it's not optimised because it cause a lot of backtracking. You can see it in regex101 (1407 steps to match)
https://regex101.com/r/fiPsS9/1
You can use \s\S+\s to match the id :
client\s\S+\s(?<dns_request_client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})#(?<dns_request_client_port>\d+).*\s(?<message_type>query):\s(?<dns_request_queried_domain>\S+)\s(?<dns_request_class_name>\w+)\s(?<dns_request_type_name>\w+)\s(?<dns_request_setDC>(?:\+|\-)\S*)\s\((?<dns_request_name_serverIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})\)
https://regex101.com/r/Dfl9pc/1
I don't have the permissions to open a case unfortunately...
... View more