Packetbeat lacks support for 100-continue request/response, which looks like:
- Client: sends request headers including
Expect: 100-continue.
- Server: responds with 100 status code (or an error, which terminates the request).
- Client: sends the request body.
- Server: Answers with a full response.
Currently this is causing Packetbeat to:
- Output an error document with "unmatched response" for the 100-continue response(2).
- Output a correct document for the rest (1,3,4).
Example with Packetbeat monitoring port 9200 for http:
curl -H 'Expect: 100-continue' -H 'Content-Type: application/json' -XPOST 'http://localhost:9200/filebeat/_doc/mydoc' --data '{}'
Produces:
{
"error": {
"message": "Unmatched response"
},
"status": "Error",
"type": "http",
"http": {
"response": {
"status_code": 100,
"bytes": 25,
"headers": {
"content-length": 0
},
"status_phrase": "continue"
}
},
[...]
}and
{
"type": "http",
"query": "POST /filebeat/_doc/mydoc",
"status": "OK",
"user_agent": {
"original": "curl/7.54.0"
},
"method": "post",
"http": {
"version": "1.1",
"request": {
"method": "post",
"bytes": 173,
"body": {
"bytes": 2
},
"headers": {
"content-type": "application/json",
"content-length": 2
}
},
"response": {
"headers": {
"content-type": "application/json; charset=UTF-8",
"content-length": 160
},
"status_phrase": "ok",
"status_code": 200,
"bytes": 247,
"body": {
"bytes": 160
}
}
},
"url": {
"port": 9200,
"path": "/filebeat/_doc/mydoc",
"full": "http://localhost:9200/filebeat/_doc/mydoc",
"scheme": "http",
"domain": "localhost"
}
[...]
}
A simple workaround is to drop the events which contain this error:
processors:
- drop_event.when:
and:
- equals.http.response.status_code: 100
- equals.error.message: 'Unmatched response'
Packetbeat lacks support for
100-continuerequest/response, which looks like:Expect: 100-continue.Currently this is causing Packetbeat to:
Example with Packetbeat monitoring port 9200 for http:
Produces:
{ "error": { "message": "Unmatched response" }, "status": "Error", "type": "http", "http": { "response": { "status_code": 100, "bytes": 25, "headers": { "content-length": 0 }, "status_phrase": "continue" } }, [...] }and
{ "type": "http", "query": "POST /filebeat/_doc/mydoc", "status": "OK", "user_agent": { "original": "curl/7.54.0" }, "method": "post", "http": { "version": "1.1", "request": { "method": "post", "bytes": 173, "body": { "bytes": 2 }, "headers": { "content-type": "application/json", "content-length": 2 } }, "response": { "headers": { "content-type": "application/json; charset=UTF-8", "content-length": 160 }, "status_phrase": "ok", "status_code": 200, "bytes": 247, "body": { "bytes": 160 } } }, "url": { "port": 9200, "path": "/filebeat/_doc/mydoc", "full": "http://localhost:9200/filebeat/_doc/mydoc", "scheme": "http", "domain": "localhost" } [...] }A simple workaround is to drop the events which contain this error: