# Issues analysing elastic traffic
**URL:** https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963
**Category:** Beats
**Tags:** packetbeat
**Created:** [May 27, 2019, 8:01pm UTC](https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963 "2019-05-27T20:01:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@humartinez](https://discuss.elastic.co/u/humartinez)
#### Post date: [May 27, 2019, 8:01pm UTC](https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963/1 "2019-05-27T20:01:39Z")
Hi,
Im trying to analyze the queries that came to my ES cluster, I manage to install packetbeat to analyze the http traffic that cames to the port 9200, and Im getting the request (and responses) but Im also having a lot of errors, this is one of the most recurrents
> **POST /\_bulk: first path segment in URL cannot contain colon**
The log is quite huge, Im thinking, maybe I should send the logs to logstash and remove the colon, but I don't know which one is the offending field.
Thanks in advance
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [May 29, 2019, 7:55am UTC](https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963/2 "2019-05-29T07:55:14Z")
Hi,
Which version of Packetbeat are you using?
Does that error appear in Packetbeat log? Can you paste the full log, including timestamps, so I can see where this error is coming from?
---
### Author:  [@humartinez](https://discuss.elastic.co/u/humartinez)
#### Post date: [May 29, 2019, 1:48pm UTC](https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963/3 "2019-05-29T13:48:57Z")
Hi im using 6.8.0, I think that the error ocurred when I enable this:
`> include_body_for: ["text/html", "application/json"]`
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [May 29, 2019, 2:20pm UTC](https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963/4 "2019-05-29T14:20:01Z")
Can you paste a log snippet so I can see where this error is coming from?
> [@humartinez](#):
>
> > include\_body\_for: ["text/html", "application/json"]
Can you confirm by testing with and without this setting?
Is it possible that you capture a `.pcap` file that reproduces this issue? (run packetbeat with the `--dump file.pcap` parameter).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2019, 2:20pm UTC](https://discuss.elastic.co/t/issues-analysing-elastic-traffic/182963/5 "2019-06-26T14:20:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.