Packetbeat, mysql proto, add \r to trim SQLs captured from app runnin… (

elastic#5572)

* Packetbeat, mysql proto, add \r to trim SQLs captured from app running on Windows server. Otherwise method extracted including \r, which is problem. e.g. "SELECT\r\n\t1"

* Packetbeat, test case for windows lineending

* Packetbeat, changelog for windows lineending

CHANGELOG.asciidoc

@@ -38,6 +38,7 @@ https://github.com/elastic/beats/compare/v5.6.8...5.6[Check the HEAD diff]
 
 - Fix http status phrase parsing not allow spaces. {pull}5312[5312]
 - Fix http parse to allow to parse get request with space in the URI. {pull}5495[5495]
+- Fix mysql SQL parser to trim `\r` from Windows Server `SELECT\r\n\t1`. {pull}5572[5572]
 
 *Winlogbeat*
 

packetbeat/protos/mysql/mysql.go

@@ -607,8 +607,8 @@ func (mysql *mysqlPlugin) receivedMysqlRequest(msg *mysqlMessage) {
 
 	// Extract the method, by simply taking the first word and
 	// making it upper case.
-	query := strings.Trim(msg.query, " \n\t")
-	index := strings.IndexAny(query, " \n\t")
+	query := strings.Trim(msg.query, " \r\n\t")
+	index := strings.IndexAny(query, " \r\n\t")
 	var method string
 	if index > 0 {
 		method = strings.ToUpper(query[:index])

packetbeat/tests/system/test_0064_mysql_windows_lineending.py

@@ -0,0 +1,24 @@
+from packetbeat import BaseTest
+
+"""
+Tests for MySQL messages with Windows line ending \\r\\n.
+"""
+
+
+class Test(BaseTest):
+
+    def test_rn(self):
+        """
+        Should get method "SELECT" instead of "SELECT\\r"
+        """
+        self.render_config_template(
+            mysql_ports=[3306],
+        )
+        self.run_packetbeat(pcap="mysql_windows_lineending.pcap")
+
+        objs = self.read_output()
+        assert len(objs) == 1
+        o = objs[0]
+
+        assert o["status"] == "OK"
+        assert o["method"] == "SELECT"