# Basic Question regarding logging

**URL:** <https://forum.suricata.io/t/basic-question-regarding-logging/6027>\
**Category:** Help\
**Created:** [September 18, 2025, 7:22pm UTC](https://forum.suricata.io/t/basic-question-regarding-logging/6027 "2025-09-18T19:22:07Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [September 18, 2025, 9:29pm UTC](https://forum.suricata.io/t/basic-question-regarding-logging/6027/2 "2025-09-18T21:29:17Z")

</div>

Hello,

I don’t think it’s possible to to filter specific sub-fields of dns (or other EVE fields) unless they’re listed in the suricata.yaml file (if needed, a simple example on how to do that can be seen here: [Logging different kind of logs in different EVE files - #2 by syoc](https://forum.suricata.io/t/logging-different-kind-of-logs-in-different-eve-files/329/2))

An alternative that comes to mind would be to filter out certain events to a different eve file. But I’m not sure this would be useful in your case.

I’m not aware of whether how you’re forwarding Suricata logs to Splunk is the best alternative or not (sorry about that bit!)

---

_[View the full topic](https://forum.suricata.io/t/basic-question-regarding-logging/6027)._