# packetbeat -e -c /etc/packetbeat/packetbeat.yml -N -I trace.pcap -t -v -d 'publish'
2016/03/07 01:36:11.285284 publish.go:202: INFO Dry run mode. All output types except the file based one are disabled.
2016/03/07 01:36:11.285588 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths
2016/03/07 01:36:11.285768 publish.go:288: INFO Publisher name: shifudaotest
2016/03/07 01:36:11.286225 beat.go:147: INFO Init Beat: packetbeat; Version: 1.1.1
2016/03/07 01:36:11.288703 beat.go:173: INFO packetbeat sucessfully setup. Start running.
2016/03/07 01:36:11.290527 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.290626 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.290676 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.290736 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.293602 pgsql.go:374: WARN Postgresql Message too short. 58 (length=1). Wait for more.
2016/03/07 01:36:11.293662 pgsql.go:374: WARN Postgresql Message too short. 58 (length=1). Wait for more.
2016/03/07 01:36:11.309933 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.323170 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.323249 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.323283 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.323315 pgsql.go:875: WARN Response from unknown transaction. Ignoring.
2016/03/07 01:36:11.630358 sniffer.go:359: INFO Input finish. Processed 5444 packets. Have a nice day!
And here is the log of packetbeat -e -c packetbeat.yml -v -d '*'.
But in the trace.pacp file, I could see the express SQL and fields.