I do get how to look/discover documents in Kibana, but sometimes it is just easier to run 1 liner in dev tools.
This is why in one of the posts I have mentioned that I can not find geo fields in documents
*please noticed I use absolute dates beyond the scope because my time zone is 3h off.
Jason form one of the documents
{
"_index": "packetbeat-7.13.1-2021.06.07-000001",
"_type": "_doc",
"_id": "yNIh53kBhVdcPS60bJZa",
"_version": 1,
"_score": null,
"fields": {
"dns.type": [
"answer"
],
"dns.answers_count": [
1
],
"event.category": [
"network_traffic",
"network"
],
"dns.question.subdomain": [
"www"
],
"host.os.name.text": [
"Windows Server 2016 Standard Evaluation"
],
"server.ip": [
"192.168.1.10"
],
"dns.answers.data": [
"212xxx9"
],
"host.hostname": [
"Logstash-cloud"
],
"type": [
"dns"
],
"host.mac": [
"00:0c:29:54:98:3b",
"00:00:00:00:00:00:00:e0"
],
"dns.answers.type": [
"A"
],
"host.os.version": [
"10.0"
],
"dns.flags.authentic_data": [
false
],
"dns.flags.authoritative": [
false
],
"dns.additionals_count": [
0
],
"host.os.name": [
"Windows Server 2016 Standard Evaluation"
],
"dns.flags.checking_disabled": [
false
],
"source.ip": [
"192.168.1.100"
],
"agent.name": [
"Logstash-cloud"
],
"network.community_id": [
"1:TqLqkXBsKAPb+XVMkuJLnbWKRFQ="
],
"host.name": [
"Logstash-cloud"
],
"dns.answers.ttl": [
83
],
"event.kind": [
"event"
],
"dns.answers.class": [
"IN"
],
"host.os.type": [
"windows"
],
"method": [
"QUERY"
],
"resource": [
"www.wp.pl"
],
"query": [
"class IN, type A, www.wp.pl"
],
"client.ip": [
"192.168.1.100"
],
"agent.hostname": [
"Logstash-cloud"
],
"dns.answers.name": [
"www.wp.pl"
],
"tags": [
"beats_input_raw_event"
],
"host.architecture": [
"x86_64"
],
"dns.question.top_level_domain": [
"pl"
],
"dns.op_code": [
"QUERY"
],
"source.port": [
63145
],
"agent.id": [
"bcc8d9d04f-6de817218886"
],
"dns.flags.recursion_available": [
true
],
"bytes_out": [
43
],
"client.port": [
63145
],
"ecs.version": [
"1.9.0"
],
"agent.version": [
"7.13.1"
],
"destination.bytes": [
43
],
"host.os.family": [
"windows"
],
"event.start": [
"2021-06-07T18:38:09.398Z"
],
"dns.question.etld_plus_one": [
"wp.pl"
],
"dns.resolved_ip": [
"212.77.98.9"
],
"status": [
"OK"
],
"dns.question.class": [
"IN"
],
"server.bytes": [
43
],
"destination.port": [
53
],
"bytes_in": [
27
],
"event.end": [
"2021-06-07T18:38:09.420Z"
],
"dns.flags.recursion_desired": [
true
],
"host.os.build": [
"14393.693"
],
"host.ip": [
"fe80::34f1:9575:daa9:b8e3",
"192.168.1.100",
"fe80::5efe:c0a8:164"
],
"agent.type": [
"packetbeat"
],
"network.protocol": [
"dns"
],
"related.ip": [
"192.168.1.100",
"192.168.1.10",
"212.77.98.9"
],
"host.os.kernel": [
"10.0.14393.693 (rs1_release.161220-1747)"
],
"dns.header_flags": [
"RD",
"RA"
],
"@version": [
"1"
],
"server.port": [
53
],
"dns.question.registered_domain": [
"wp.pl"
],
"network.bytes": [
70
],
"dns.authorities_count": [
0
],
"network.direction": [
"egress"
],
"dns.question.name": [
"www.wp.pl"
],
"host.id": [
"46f9251b9-8490c1fa9c5b"
],
"network.type": [
"ipv4"
],
"source.bytes": [
27
],
"dns.id": [
"21188"
],
"dns.question.type": [
"A"
],
"destination.ip": [
"192.168.1.10"
],
"network.transport": [
"udp"
],
"event.duration": [
21774000
],
"dns.flags.truncated_response": [
false
],
"@timestamp": [
"2021-06-07T18:38:09.398Z"
],
"host.os.platform": [
"windows"
],
"client.bytes": [
27
],
"event.type": [
"connection",
"protocol"
],
"agent.ephemeral_id": [
"907c6e151b649982033"
],
"dns.response_code": [
"NOERROR"
],
"event.dataset": [
"dns"
]
},
"highlight": {
"dns.question.registered_domain": [
"@kibana-highlighted-field@wp.pl@/kibana-highlighted-field@"
],
"dns.question.etld_plus_one": [
"@kibana-highlighted-field@wp.pl@/kibana-highlighted-field@"
]
},
"sort": [
1623091089398
]
}
from where 
