mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
363b167bd2
The body-lengths of sub-entities, like multipart messages, got counted twice by mistake: once upon the end of the sub-entity and then again upon the end of the top-level entity that contains all sub-entities. The size of just the top-level entity is the correct one to use.
10 lines
975 B
Text
10 lines
975 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path http
|
|
#open 2020-08-04-21-12-03
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
|
|
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
|
|
1596519557.155703 CHhAvVGS1DHFjwGM9 127.0.0.1 45376 127.0.0.1 8000 1 POST localhost / - - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 null 767 0 - - - - (empty) - - - FeaAeS2KrXTNRvTtBh test.txt text/plain - - -
|
|
#close 2020-08-04-21-12-03
|