# Couldn't get HTTP POST content

**URL:** <https://discuss.elastic.co/t/couldnt-get-http-post-content/56684>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [July 28, 2016, 11:41pm UTC](https://discuss.elastic.co/t/couldnt-get-http-post-content/56684 "2016-07-28T23:41:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![junhuih](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@junhuih](https://discuss.elastic.co/u/junhuih)\
**Post date:** [July 28, 2016, 11:41pm UTC](https://discuss.elastic.co/t/couldnt-get-http-post-content/56684/1 "2016-07-28T23:41:53Z")

</div>

when i'm trying to use packetbeat, but couldn't get the http post content, from the official demo site, it have the post content. not sure how to set it up, anybody can help?

tried open following:

send\_all\_headers: true  
send\_request: true  
but, they're both on header level. **include\_body\_for** can only get http response body.

how to get http request body like post content? thanks a lot!

- Version: packetbeat-5.0.0-alpha4-linux-x86\_64]

---

<div class="post-metadata">

**Author:** ![junhuih](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@junhuih](https://discuss.elastic.co/u/junhuih)\
**Post date:** [July 29, 2016, 12:11am UTC](https://discuss.elastic.co/t/couldnt-get-http-post-content/56684/2 "2016-07-29T00:11:11Z")

</div>

for some http have the post body in **params** , most of the post http request don't have body

i see for official demo site, can have post body in **request** like below:

```auto
POST /login HTTP/1.1
Host: packetbeat.com
Connection: keep-alive
Content-Length: 43
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://packetbeat.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17
Content-Type: application/x-www-form-urlencoded
Referer: http://packetbeat.com/login
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmx=149357239.NSUz4QmJReWsXw6TN26IIQ$68934090-0:1;__ utmxx=149357239.NSUz4QmJReWsXw6TN26IIQ$68934090-0:1361226084:15552000; __utma=149357239.1198651862.1361225966.1361696899.1361704280.9;__ utmb=149357239.4.10.1361704280; __utmc=149357239;__ utmz=149357239.1361304733.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); session="c3L2Pn5ymhiytth5Sg1YgNRyGWI=?_id=Uyc/XHhlOVx4OWJceGZjXHhlMVx4OWVceGQyXHg4Nlx4ZjJBXHg4OFlceDhjRVx4ODZceDhiJwpwMQou&selected_transactions=KGxwMQpWNTEyOWU0Yjg0NzQxMDQ5OWQ2OTU3NTgwCnAyCmFWNTEyOWU0YmE0NzQxMDQ5OWQ2OTU3NTgxCnAzCmEu"

Email=packetbeat%40example.com&Password= ****

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2016, 11:42pm UTC](https://discuss.elastic.co/t/couldnt-get-http-post-content/56684/3 "2016-08-18T23:42:09Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.