# DNS Lookup from packetbeat
**URL:** https://discuss.elastic.co/t/dns-lookup-from-packetbeat/136165
**Category:** Elasticsearch
**Created:** [June 16, 2018, 7:39am UTC](https://discuss.elastic.co/t/dns-lookup-from-packetbeat/136165 "2018-06-16T07:39:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Drav3nmc](https://discuss.elastic.co/u/Drav3nmc)
#### Post date: [June 16, 2018, 7:39am UTC](https://discuss.elastic.co/t/dns-lookup-from-packetbeat/136165/1 "2018-06-16T07:39:57Z")
Hi
I have just set up elasticsearch with kibana and I am currently sending packetbeat data from one of my servers directly to elasticsearch, not using logstash and a plain packetbeat config.
The data is being shown perfectly and can see the source ip and destination port information that I need but I would like to do a DNS lookup on the IP address so I can see the hostnames to make the dashboard I am trying to build more user friendly / management ready.
Is this possible with just using packetbeat and elasticsearch or do I need to send the data through logstash to have the dns processed?
thanks
mark
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 16, 2018, 8:03am UTC](https://discuss.elastic.co/t/dns-lookup-from-packetbeat/136165/2 "2018-06-16T08:03:40Z")
You would need to send events to Logstash and then use the DNS filter to do this, but it's possible.
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [June 17, 2018, 8:31am UTC](https://discuss.elastic.co/t/dns-lookup-from-packetbeat/136165/3 "2018-06-17T08:31:21Z")
What is curious is that for socket data provided by the metricbeat system module there is the option to do reverse lookups:
```auto
socket:
reverse_lookup:
enabled: true
success_ttl: 900s
failure_ttl: 900s
```
That this is available in Metricbeat and not Packetbeat is just another of the inconsistencies in Beats.
I would definitely recommend sending the Beats data to Logstash to be transformed into a more usable form and further enriched (alternatively you could send it to Kafka and write Streams API apps to fix the data). Doing so will allow you to extract a lot more value from the data than is possible with the out-of-the-box schema.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2018, 8:31am UTC](https://discuss.elastic.co/t/dns-lookup-from-packetbeat/136165/4 "2018-07-15T08:31:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.