...
The full tag will have just three levels. The first two are fixed as dns.bind. The third level describes the event message content in terms of the event's BIND category and must be either query or info. Query events are all those log messages in the queries BIND category. Events with any other BIND category value are assigned info as the third tag level.
technology | brand | log type/format |
|---|---|---|
| dns | bind |
|
Therefore, the valid tags include:
...