Wrong phrase in the http.response.phrase field

Elastic Stack Beats
1

Hi,

It appears that Packetbeat 5.5.0 (the HTTP module) only gets the last word from HTTP status line when searching for the response phrase.
HTTP/1.1 500 Internal Server Error turns into "Error" in the http.response.phrase field and HTTP/1.1 404 Not Found gets parsed as "Found".

Here are some examples of response headers and HTTP status lines (as reported by curl) that were not parsed correctly by Packetbeat:

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 949
Date: Mon, 31 Jul 2017 11:31:53 GMT

HTTP/1.1 500 Internal Server Error
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 3739
Date: Mon, 31 Jul 2017 11:33:28 GMT
Connection: close

Apart from the response phrase, I haven't noticed any other erroneous values being reported by Packetbeat.

2

That's weird. Can you open a bug report, so this can be tracked? Thanks.

3

Yep, opened issue #4795.

4

Thank you!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.