I do, but with a different log aggregator (vector.dev), there are three reasons: 1. the log aggregator doesn't exactly support DNS lookups 2. You have to pars

I do, but with a different log aggregator (vector.dev), there are three reasons: 1. the log aggregator doesn't exactly support DNS lookups 2. You have to parse the log first, exactly precisely where the IP part, then do a proper lookup. But sometimes the log is just a mess. 3. where the log aggregator located cannot do host lookup because of different network and different DNS server. So overall the lookup would better be done locally.