for supporting JSON logs from Zeek (idaholab#65); almost certainly br…

…oken at this point
mmguero-dev · Feb 21, 2024 · 26f7238 · 26f7238
1 parent 0879cea
commit 26f7238
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/logstash/pipelines/zeek/12_zeek_mutate.conf b/logstash/pipelines/zeek/12_zeek_mutate.conf
@@ -755,7 +755,7 @@ filter {
           query = uri.nil? ? nil : uri.partition('?').last
           event.set('[url][scheme]', scheme)
           event.set('[url][original]', scheme + '://' + (host.nil? ? '' : host) + (uri.nil? ? '' : uri))
-          event.set('[url][full]', scheme + '://' + (user.nil? ? '' : Array(user).first) + (password.nil? ? '' : ':' + password) + ((user.nil? && password.nil?) ? '' : '@') + (host.nil? ? '' : host) + (port.nil? ? '' : ':' + port.to_s) + (uri.nil? ? ''  uri))
+          event.set('[url][full]', scheme + '://' + (user.nil? ? '' : Array(user).first) + (password.nil? ? '' : ':' + password) + ((user.nil? && password.nil?) ? '' : '@') + (host.nil? ? '' : host) + (port.nil? ? '' : ':' + port.to_s) + (uri.nil? ? '' : uri))
           event.set('[url][domain]', host) unless host.nil?
           event.set('[url][extension]', ext) unless ext.nil? || ext.empty?
           event.set('[url][fragment]', fragment) unless fragment.nil? || fragment.empty?