Corrupted messages when using PGSQL protocol

Elastic Stack Beats
1

We are using packetbeat version 6.2.4 to log all SQL requests.
The relevant part of configuration is:

packetbeat.flows:
  enabled: false

packetbeat.protocols:
- type: pgsql
  ports: [5432]
  send_request: true
  send_response: false

Those requests are logged and we can see them using kibana.
The problem is that every message containing character ; is corrupted.
That means data after this ; are dropped.
I think there's a problem with packetbeat which thinks that there are more than one SQL statements and tries to create document for every of them.
for example:

(samsung SM-G950F; OS Android 8.0.0, api 26, base: ; pol)

get's logged as:

(samsung SM-G950F

the rest of message is lost.

Is there any way this can be mitigated?
If not should I create bug report on GITHUB?

Thank you

2

Hi @kauf,

Thank you for your feedback! This looks a lot like a bug, I think it would be best if you create a new issue: https://github.com/elastic/beats/issues/new

Best regards

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.