It would be nice to track "Differentiated Services" field (see RFC2474) and have it available as exported field in Packetbeat.
It is the second bytes in the IPv4 header (the old TOS field) and bits 4 to 11 in the IPv6 header.
Currently I have 3 class of service and I'm using the
bpf_filter options to filter at low level. But I have to run 3 Packetbeat instances, one for each class. This solution does not scale very well.
Thanks for your support.