Capturing DNS @ Packetbeat

Hi, I am currently doing research with Packetbeat for some project. I did realize the DNS was captured in a JSON, msg with Query and Answer. Just wonder is there any configuration that I could have get the result in both msg, JSON instead of one.

Example: JSON:

"method": "QUERY",
"destination": {
"ip": "",
"port": 53,
"bytes": 45

"type": "dns",
"resource": "",
"network": {
"transport": "udp",
"protocol": "dns",
"direction": "outbound",
"community_id": "1:kCntm9yW9MhVnSZn6e3GeKdBpX4=",
"bytes": 74,
"type": "ipv4"

"answers": [
    "class": "IN",
    "ttl": "5",
    "data": "",
    "name": "",
    "type": "A"

Example - tcpdump:
11:23:59.711153 IP localhost.localdomain.33822 > gateway.domain: 25727+ A? (29)
11:23:59.712079 IP localhost.localdomain.37646 > gateway.domain: 40721+ PTR? (44)
11:23:59.719206 IP gateway.domain > localhost.localdomain.33822: 25727 4/0/0 A, A, A, A (93)

Question: can we get dns query in one JSON / msg, while the answer in another JSON / msg?

Thank you.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.