Suricata

If the eve DNS format field is not set at all you get grouped and an array of answers. If it is set, but has no value you get no answers at all. This is surely not the intention. If set, but empty it should use the default which is grouped and an array. If the format is uncommented, at least one output type should be chosen.