WARNING: Version 6.0 of Packetbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
DNS Fields
editDNS Fields
editDNS-specific event fields.
dns.id
edittype: long
The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
dns.op_code
editexample: QUERY
The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.
dns.flags.authoritative
edittype: boolean
A DNS flag specifying that the responding server is an authority for the domain name used in the question.
dns.flags.recursion_available
edittype: boolean
A DNS flag specifying whether recursive query support is available in the name server.
dns.flags.recursion_desired
edittype: boolean
A DNS flag specifying that the client directs the server to pursue a query recursively. Recursive query support is optional.
dns.flags.authentic_data
edittype: boolean
A DNS flag specifying that the recursive server considers the response authentic.
dns.flags.checking_disabled
edittype: boolean
A DNS flag specifying that the client disables the server signature validation of the query.
dns.flags.truncated_response
edittype: boolean
A DNS flag specifying that only the first 512 bytes of the reply were returned.
dns.response_code
editexample: NOERROR
The DNS status code.
dns.question.name
editexample: www.google.com.
The domain name being queried. If the name field contains non-printable characters (below 32 or above 126), then those characters are represented as escaped base 10 integers (\DDD). Back slashes and quotes are escaped. Tabs, carriage returns, and line feeds are converted to \t, \r, and \n respectively.
dns.question.type
editexample: AAAA
The type of records being queried.
dns.question.class
editexample: IN
The class of of records being queried.
dns.question.etld_plus_one
editexample: amazon.co.uk.
The effective top-level domain (eTLD) plus one more label. For example, the eTLD+1 for "foo.bar.golang.org." is "golang.org.". The data for determining the eTLD comes from an embedded copy of the data from http://publicsuffix.org.
dns.answers
edittype: object
An array containing a dictionary about each answer section returned by the server.
dns.answers_count
edittype: long
The number of resource records contained in the dns.answers
field.
dns.answers.name
editexample: example.com.
The domain name to which this resource record pertains.
dns.answers.type
editexample: MX
The type of data contained in this resource record.
dns.answers.class
editexample: IN
The class of DNS data contained in this resource record.
dns.answers.ttl
edittype: long
The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.
dns.answers.data
editThe data describing the resource. The meaning of this data depends on the type and class of the resource record.
dns.authorities
edittype: object
An array containing a dictionary for each authority section from the answer.
dns.authorities_count
edittype: long
The number of resource records contained in the dns.authorities
field. The dns.authorities
field may or may not be included depending on the configuration of Packetbeat.
dns.authorities.name
editexample: example.com.
The domain name to which this resource record pertains.
dns.authorities.type
editexample: NS
The type of data contained in this resource record.
dns.authorities.class
editexample: IN
The class of DNS data contained in this resource record.
dns.additionals
edittype: object
An array containing a dictionary for each additional section from the answer.
dns.additionals_count
edittype: long
The number of resource records contained in the dns.additionals
field. The dns.additionals
field may or may not be included depending on the configuration of Packetbeat.
dns.additionals.name
editexample: example.com.
The domain name to which this resource record pertains.
dns.additionals.type
editexample: NS
The type of data contained in this resource record.
dns.additionals.class
editexample: IN
The class of DNS data contained in this resource record.
dns.additionals.ttl
edittype: long
The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.
dns.additionals.data
editThe data describing the resource. The meaning of this data depends on the type and class of the resource record.
dns.opt.version
editexample: 0
The EDNS version.
dns.opt.do
edittype: boolean
If set, the transaction uses DNSSEC.
dns.opt.ext_rcode
editexample: BADVERS
Extended response code field.
dns.opt.udp_size
edittype: long
Requestor’s UDP payload size (in bytes).