diff --git a/protos/http/http.go b/protos/http/http.go index dc302c08e202..ce8798d99ce8 100644 --- a/protos/http/http.go +++ b/protos/http/http.go @@ -791,6 +791,7 @@ func (http *Http) PublishTransaction(t *HttpTransaction) { } event["method"] = t.Method event["path"] = t.RequestUri + event["query"] = fmt.Sprintf("%s %s", t.Method, t.RequestUri) event["params"] = t.Params event["@timestamp"] = common.Time(t.ts) diff --git a/tests/test_0024_http_query.py b/tests/test_0024_http_query.py new file mode 100644 index 000000000000..9d149c433524 --- /dev/null +++ b/tests/test_0024_http_query.py @@ -0,0 +1,37 @@ +from pbtests.packetbeat import TestCase + +""" +Tests for checking that HTTP query is filled. +""" + + +class Test(TestCase): + + def test_http_post(self): + """ + Should be able to parse the parameters from the HTTP POST request. + """ + self.render_config_template() + self.run_packetbeat(pcap="http_post.pcap", + debug_selectors=["http", "httpdetailed"]) + objs = self.read_output() + + assert len(objs) == 1 + o = objs[0] + assert o["type"] == "http" + assert o["query"] == "POST /register" + + def test_http_get(self): + """ + Should be able to parse the parameters from the HTTP POST request. + """ + self.render_config_template() + self.run_packetbeat(pcap="http_url_params.pcap", + debug_selectors=["http", "httpdetailed"]) + objs = self.read_output() + + assert len(objs) == 1 + o = objs[0] + assert o["type"] == "http" + assert o["query"] == "GET /dashboard/transactions?" + \ + "input=packetbeat&src_ip=192.35.243.1"