mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
363b167bd2
The body-lengths of sub-entities, like multipart messages, got counted twice by mistake: once upon the end of the sub-entity and then again upon the end of the top-level entity that contains all sub-entities. The size of just the top-level entity is the correct one to use.
10 lines
943 B
Text
10 lines
943 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path http
|
|
#open 2020-04-30-00-47-18
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
|
|
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
|
|
1369159408.455878 CHhAvVGS1DHFjwGM9 141.142.228.5 57262 54.243.88.146 80 1 POST httpbin.org /post - 1.1 curl/7.30.0 - 350 465 200 OK - - (empty) - - - F7GxTo3GBQtouewvQ3,FxoQEm2z4L7qn9fu89,FUSlBt3LAo6IXh1TPe - - Fq3bOc1S5TIYOy2Yy - text/json
|
|
#close 2020-04-30-00-47-18
|