DataStream bundles and uploads log records with selected data set fields to a destination of your choice at selected time intervals. This depends on the log push frequency (30 or 60 seconds) you set while configuring your destination.

Depending on the destination, DataStream 2 can send logs either in the Structured (space- or tab-delimited) or JSON log file format.

Note that in each format the stream version (for example, 1) comes before the values for the data set fields in the log line. This includes the optional Line Type field which marks logs for end users’ DNS queries with Q and responses with R.

Here’s a sample Structured log line with AnswerX (rDNS) data:

1 Q 1757529533.310 r_12 1088 ZAM 1.2.3.0/24/0 U 232 1.2.3.4 44257 2.3.4.5 4691 example.com A IN 4CDE00000001... key1=val1;device_id=;core_domain=example.com.;customer=acme NOERROR 2 1 +TC

JSON log sample:

{
  "version": "1",
  "lineType": "Q",
  "timeStamp": "1757529533.310",
  "insId": "r_12",
  "serviceId": "1088",
  "dnsBlockReason": "ZAM",
  "ecs": "1.2.3.0/24/0",
  "transProto": "U",
  "pktLen": "232",
  "clientIp": "1.2.3.4",
  "clientPort": "44257",
  "servicePort": "2.3.4.5",
  "qId": "4691",
  "qName": "example.com",
  "qType": "A",
  "qClass": "IN",
  "dnsHex": "4CDE00000001...",
  "metadata": "key1=val1;device_id=;core_domain=example.com.;customer=acme",
  "rCode": "NOERROR",
  "rTime": "2",
  "cacheHit": "1",
  "flags": "+TC"
}

Data set fields

Choose from the data set fields listed below to log different kinds of data related to recursive DNS query in AnswerX.

The available fields provide improved visibility into DNS transaction data, query types, response codes, transport protocols, and metadata.

The optional Line Type field marks log lines with details about end user DNS queries with Q and responses with R.

Data element	JSON key	Examples	Description
Line Type	`lineType`	Q, R	Marks log lines for end user DNS queries (`Q`) and responses (`R`).
Epoch Timestamp	`timeStamp`	1757529533.310	The time the event was recorded in Unix epoch format.
Instance ID	`insId`	r_12	Identifies the Akamai Recursive DNS Cloud where the Service ID belonging to the stream is deployed.
Service ID	`serviceId`	1088	The Service Subletter ID (SSID) that identifies the Akamai Recursive DNS service account.
Block Reason	`dnsBlockReason`	ZAM	The reason code for blocked DNS queries. Returns a hyphen (-) in R lines (see Line Type) unless AnswerX responds to the client.
EDNS Client Subnet	`ecs`	1.2.3.0/24/0	Returns the Extended DNS Client Subnet from the OPT Resource reports in the “address/request mask bits/response mask bits” format. “`-`“ if not present. See Client Subnet in DNS Queries in RFC 7871 for details.
Transport Protocol	`transProto`	U, T, ODOH	The protocol used for the DNS query (UDP, TCP or DoH).
Packet Length	`pktLen`	232	The length of the DNS packet in bytes. Request bytes for `Q` lines or response bytes for `R` lines (see Line Type). Doesn’t include overheads for HTTP/TCP/UDP, IP and Ethernet framing.
Client IP	`clientIp`	1.2.3.4	The source IP address of the client for Q query lines, destination address for R response lines. Includes IPv6.
Client Port	`clientPort`	44257	The source port of the client.
Service Port	`servicePort`	2.3.4.5	The Akamai DNS service IP port.
Query ID	`qId`	4691	The unique ID for the DNS query packet.
Query Name	`qName`	example.com	Lower-cased query `NAME` from the the first Question Resource Record in the DNS packet or "`-`" if none. Query names in the packet hex field may contain uppercase letters or multiple names.
Query Type	`qType`	A, AAAA, CNAME	The DNS record type.
Query Class	`qClass`	IN	The DNS class of the query.
Hex-encoded DNS Packet	`dnsHex`	4CDE00000001...	The raw DNS packet content encoded in hexadecimal, including the header and Resource Record bytes. Truncated if exceeds 64kB. Hex bytes and bits ordered in the RFC 6895 format.
Metadata	`metadata`	key1=val1;key2=val2…	Additional metadata key-value pairs related to the DNS request or response.
Response Code	`rCode`	NOERROR	The DNS response code from the DNS packet converted from hexadecimal to plain text.
Response Latency	`rTime`	2	The time the server took to respond to the DNS query excluding operating system, NIC and network delays (in milliseconds).
Cache Hit	`cacheHit`	1	Indicates whether the response was served from cache (`1`) or not (`0`).
DNS Flags	`flags`	+TC	The DNS message flags present in the packet. Contains “`+`” if the DNS header requested Recursion, “`T`” if TCP was used, and “`C`” if Checking disabled in the DNS header.