json export multiple layers    
   I have a captured structure package
[
  {
    "_index": "packets-2022-01-25",
    "_type": "doc",
    "_score": null,
    "_source": {
      "layers": {
        "frame": {
          "filtered": "frame"
        },
        "eth": {
          "filtered": "eth"
        },
        "ip": {
          "filtered": "ip"
        },
        "sctp": {
          "filtered": "sctp"
        },
        "s1ap": {
          "filtered": "s1ap"
        },
        "sctp": {
          "filtered": "sctp"
        },
        "s1ap": {
          "filtered": "s1ap"
        }
      }
    }
  }
]
command -T json -e s1ap.CellIdentity -e s1ap.ENB_UE_S1AP_ID -e s1ap.m_TMSI return
[
  {
    "_index": "packets-2022-01-25",
    "_type": "doc",
    "_score": null,
    "_source": {
      "layers": {
        "s1ap.CellIdentity": [
          "0x06eddd33",
          "0x06eddd34"
        ],
        "s1ap.ENB_UE_S1AP_ID": [
          "278442",
          "278472"
        ],
        "s1ap.m_TMSI": [
          "4195248394"
        ]
      }
    }
  }
]
how can I find out which layer belongs to "s1ap.m_TMSI": ["4195248394"]
perhaps there are ways to fill in fields in the absence of values?
 
 

Can you share a packet capture file with this structure?
Sample packet capture file http://filesharing24.com/d/N8n
(more)