# Missing some fields in some document

**URL:** <https://discuss.elastic.co/t/missing-some-fields-in-some-document/341066>\
**Category:** Beats\
**Tags:** beats-module, packetbeat\
**Created:** [August 18, 2023, 3:02am UTC](https://discuss.elastic.co/t/missing-some-fields-in-some-document/341066 "2023-08-18T03:02:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thutrang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thutrang/32/124719_2.png) [@thutrang](https://discuss.elastic.co/u/thutrang)\
**Post date:** [August 18, 2023, 3:02am UTC](https://discuss.elastic.co/t/missing-some-fields-in-some-document/341066/1 "2023-08-18T03:02:35Z")

</div>

I am using Packetbeat version 7.12.1 to collect DNS data from network flows, then sending it to Logstash, and finally forwarding it to Elasticsearch. I am encountering an issue where certain documents in Elasticsearch are missing the fields event.start, event.duration, and client.bytes, while these fields are present in other documents.

Could you please help me understand the reasons behind this and provide guidance on how to resolve it? Thank you very much

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 18, 2023, 3:51am UTC](https://discuss.elastic.co/t/missing-some-fields-in-some-document/341066/2 "2023-08-18T03:51:04Z")

</div>

There could be several reasons for this. One thing to check is if there is another event for the same DNS transaction (`dns.id`) between the same source/destination that is complete. Sometimes a client will broadcast the same request more than once. Packetbeat has to associate the two sides of the transaction before generating an event. Duplicate requests can cause issues with that association algorithm. Packetbeat populates the `notes` field when it has issues like this.

---

<div class="post-metadata">

**Author:** ![thutrang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thutrang/32/124719_2.png) [@thutrang](https://discuss.elastic.co/u/thutrang)\
**Post date:** [August 30, 2023, 10:06am UTC](https://discuss.elastic.co/t/missing-some-fields-in-some-document/341066/3 "2023-08-30T10:06:53Z")

</div>

Thank you so much for your reply, I will check that information again

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2023, 12:07pm UTC](https://discuss.elastic.co/t/missing-some-fields-in-some-document/341066/4 "2023-09-27T12:07:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.