What’s the best way to decompress a compressed HTTP body? I think using a bespoke ruby function in Logstash could do it (although I’d need to learn ruby first and Logstash doesn’t give you the most user friendly error codes), but could Packetbeat do it?
If you'd like to open an enhancement request for packetbeat, feel free to open an issue here: https://github.com/elastic/beats/issues .
Otherwise, it's probably doable in Logstash with the ruby filter.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.