Packetbeat reports this information. The client_ip is the IP address of the host that sent the DNS request the ip is the address of the host that responded.
Perhaps you are monitoring the wrong interface or something similar that causes you to only be looking at the queries made by the recursive resolver on behalf of the client. BTW if the resolver supports sending it then you will be see the EDNS client subnet reported by Packetbeat (IIRC dns.opt.subnet is the field) for the requests made by the recursive resolver.