Fill in the Query for HTTP transactions

protos/http/http.go

@@ -791,6 +791,7 @@ func (http *Http) PublishTransaction(t *HttpTransaction) {
 	}
 	event["method"] = t.Method
 	event["path"] = t.RequestUri
+	event["query"] = fmt.Sprintf("%s %s", t.Method, t.RequestUri)
 	event["params"] = t.Params
 
 	event["@timestamp"] = common.Time(t.ts)

tests/test_0024_http_query.py

@@ -0,0 +1,37 @@
+from pbtests.packetbeat import TestCase
+
+"""
+Tests for checking that HTTP query is filled.
+"""
+
+
+class Test(TestCase):
+
+    def test_http_post(self):
+        """
+        Should be able to parse the parameters from the HTTP POST request.
+        """
+        self.render_config_template()
+        self.run_packetbeat(pcap="http_post.pcap",
+                            debug_selectors=["http", "httpdetailed"])
+        objs = self.read_output()
+
+        assert len(objs) == 1
+        o = objs[0]
+        assert o["type"] == "http"
+        assert o["query"] == "POST /register"
+
+    def test_http_get(self):
+        """
+        Should be able to parse the parameters from the HTTP POST request.
+        """
+        self.render_config_template()
+        self.run_packetbeat(pcap="http_url_params.pcap",
+                            debug_selectors=["http", "httpdetailed"])
+        objs = self.read_output()
+
+        assert len(objs) == 1
+        o = objs[0]
+        assert o["type"] == "http"
+        assert o["query"] == "GET /dashboard/transactions?" + \
+                             "input=packetbeat&src_ip=192.35.243.1"