diff --git a/salt/elasticsearch/files/ingest/zeek.dns b/salt/elasticsearch/files/ingest/zeek.dns
index 2df71a8e4..43853ffe8 100644
--- a/salt/elasticsearch/files/ingest/zeek.dns
+++ b/salt/elasticsearch/files/ingest/zeek.dns
@@ -164,6 +164,7 @@
                         "ignore_failure": true
                     }
                 },
+                "if": "ctx.dns != null && ctx.dns.answers != null && ctx.dns.answers.name != null",
                 "ignore_failure": true
             }
         },