Packetbeat: http.content_lenth fields is for request or response

Elastic Stack Beats
1

Hello { ES World },

The field, http.content_length in HTTP field list, whether it is request content length
or it is response content length?

As we want to dashboard, Responses based on their sizes; we're gonna need this field.

2

It looks like http.content_length is from the response's header.

Source: https://github.com/elastic/beats/blob/master/packetbeat/protos/http/http.go#L460

3

You are right. It's ambiguous at the moment. I created a new GitHub issue with a potential solution for this. Please let me know what you think.

1 Like
4

I agree @monica