Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] httpjson - add option for capturing a trace data #32402

Closed
andrewkroh opened this issue Jul 19, 2022 · 1 comment · Fixed by #32412
Closed

[Filebeat] httpjson - add option for capturing a trace data #32402

andrewkroh opened this issue Jul 19, 2022 · 1 comment · Fixed by #32412
Assignees

Comments

@andrewkroh
Copy link
Member

andrewkroh commented Jul 19, 2022

Describe the enhancement:

As a user of the httpjson input that is developing configuration I would like to have a way of viewing the exact requests and responses associated with the input. When communicating in the clear with HTTP you can use tcpdump to see the raw requests and responses, but HTTPS is so common that this is rarely an option.

My proposal is to add an config option that writes timestamped requests and responses to a file via https://pkg.go.dev/net/http/httputil@go1.18.4#DumpRequestOut and https://pkg.go.dev/net/http/httputil@go1.18.4#DumpResponse. The file should automatically rotate based on size.

I considered adding an option to set a KeyLogWriter in the tls.Config to allow decrypting a pcap of HTTPS traffic, but I think a plain text file will be user to use.

Describe a specific use case for the enhancement or feature:

When a user needs to debug the httpjson input during development they would enable the trace logging option to see the complete request and responses captured to a file.

@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants