# Failed to understand HTTP response

**URL:** <https://discuss.elastic.co/t/failed-to-understand-http-response/117036>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [January 25, 2018, 11:42am UTC](https://discuss.elastic.co/t/failed-to-understand-http-response/117036 "2018-01-25T11:42:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbudnick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbudnick/32/27555_2.png) [@mbudnick](https://discuss.elastic.co/u/mbudnick)\
**Post date:** [January 25, 2018, 11:42am UTC](https://discuss.elastic.co/t/failed-to-understand-http-response/117036/1 "2018-01-25T11:42:02Z")

</div>

I use packetbeat 6.1.2 to log http traffic with tomcat 8.  
Many servlet request shows a warning "Failed to understand HTTP response".

What can I do?

Snipped from Loggin:

2018-01-25T10:50:48Z DBG [sniffer] Packet number: 15  
2018-01-25T10:50:48Z DBG [decoder] decode packet data  
2018-01-25T10:50:48Z DBG [decoder] IPv4 packet  
2018-01-25T10:50:48Z DBG [decoder] TCP packet  
2018-01-25T10:50:48Z DBG [decoder] Ignore empty non-FIN packet  
2018-01-25T10:50:49Z DBG [sniffer] Packet number: 16  
2018-01-25T10:50:49Z DBG [decoder] decode packet data  
2018-01-25T10:50:49Z DBG [decoder] IPv4 packet  
2018-01-25T10:50:49Z DBG [decoder] TCP packet  
2018-01-25T10:50:49Z DBG [tcp] tcp flow id: 0x0  
2018-01-25T10:50:49Z DBG [tcp] pkt.start\_seq=1840626657 pkt.last\_seq=1840627328 stream.last\_seq=0 (len=671)  
2018-01-25T10:50:49Z DBG [httpdetailed] Payload received: [HTTP/1.1 302  
Cache-Control: no-cache, no-store, max-age=0, must-revalidate  
Pragma: no-cache  
Expires: 0  
X-XSS-Protection: 1; mode=block  
X-Frame-Options: SAMEORIGIN  
X-Content-Type-Options: nosniff  
Content-Security-Policy: default-src 'self'; frame-src \*; script-src 'self' 'unsafe-inline' 'unsafe-eval' 127.0.0.1:9876; style-src 'self' 'unsafe-inline' 127.0.0.1:9876; img-src 'self' blob: data: 127.0.0.1:9876; font-src 'self' data: 127.0.0.1:9876;  
Set-Cookie: JSESSIONID=D04A1788FA9E2F05395F57F743032FA8.tomcat80; Path=/; HttpOnly  
Location: [http://172.17.0.12:8080/resources/userinfo](http://172.17.0.12:8080/resources/userinfo)  
Content-Length: 0  
Date: Thu, 25 Jan 2018 10:50:48 GMT  
Connection: close

]  
2018-01-25T10:50:49Z DBG [http] parseResponseStatus: 302  
2018-01-25T10:50:49Z WARN Failed to understand HTTP response status: 302

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 25, 2018, 12:18pm UTC](https://discuss.elastic.co/t/failed-to-understand-http-response/117036/2 "2018-01-25T12:18:13Z")

</div>

This seems to be a bug in Packetbeat's HTTP parsing. I've opened an bug report.

> <https://github.com/elastic/beats/issues/6176>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2018, 12:18pm UTC](https://discuss.elastic.co/t/failed-to-understand-http-response/117036/3 "2018-02-22T12:18:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.