# Capturing DNS @ Packetbeat

**URL:** <https://discuss.elastic.co/t/capturing-dns-packetbeat/196692>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [August 26, 2019, 3:25am UTC](https://discuss.elastic.co/t/capturing-dns-packetbeat/196692 "2019-08-26T03:25:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaipeng.tan](https://avatars.discourse-cdn.com/v4/letter/k/aeb1de/32.png) [@kaipeng.tan](https://discuss.elastic.co/u/kaipeng.tan)\
**Post date:** [August 26, 2019, 3:25am UTC](https://discuss.elastic.co/t/capturing-dns-packetbeat/196692/1 "2019-08-26T03:25:47Z")

</div>

Hi, I am currently doing research with Packetbeat for some project. I did realize the DNS was captured in a JSON, msg with Query and Answer. Just wonder is there any configuration that I could have get the result in both msg, JSON instead of one.

Example: JSON:

"method": "QUERY",  
"destination": {  
"ip": "192.168.205.2",  
"port": 53,  
"bytes": 45

"type": "dns",  
"resource": "[youtube.com](http://youtube.com)",  
"network": {  
"transport": "udp",  
"protocol": "dns",  
"direction": "outbound",  
"community\_id": "1:kCntm9yW9MhVnSZn6e3GeKdBpX4=",  
"bytes": 74,  
"type": "ipv4"

```
"answers": [
  {
    "class": "IN",
    "ttl": "5",
    "data": "172.217.26.78",
    "name": "youtube.com",
    "type": "A"
  }

```

Example - tcpdump:  
11:23:59.711153 IP localhost.localdomain.33822 \> gateway.domain: 25727+ A? [youtube.com](http://youtube.com). (29)  
11:23:59.712079 IP localhost.localdomain.37646 \> gateway.domain: 40721+ PTR? 2.205.168.192.in-addr.arpa. (44)  
11:23:59.719206 IP gateway.domain \> localhost.localdomain.33822: 25727 4/0/0 A 172.217.194.136, A 172.217.194.93, A 172.217.194.91, A 172.217.194.190 (93)

Question: can we get dns query in one JSON / msg, while the answer in another JSON / msg?

Thank you.

Regards  
Kaipeng

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2019, 3:25am UTC](https://discuss.elastic.co/t/capturing-dns-packetbeat/196692/2 "2019-09-23T03:25:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.