From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 6 Jun 2023 19:54:49 +0000 (+0200)
Subject: doc: upgrade guide for logging http custom headers
X-Git-Tag: suricata-7.0.0-rc2~52
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5c419b79b7fd0c068b04e783f300ba4919c1b7f7;p=thirdparty%2Fsuricata.git

doc: upgrade guide for logging http custom headers

Ticket: #5320
---

diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index 0dd7223dfc..c4807b4173 100644
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -60,6 +60,9 @@ Logging changes
 - Protocol values and their names are built into Suricata instead of using the system's ``/etc/protocols`` file. Some names and casing may have changed
   in the values ``proto`` in ``eve.json`` log entries and other logs containing protocol names and values.
   See https://redmine.openinfosecfoundation.org/issues/4267 for more information.
+- Custom logging of HTTP headers via suricata.yaml ``outputs.eve-log.types.http.custom``
+  is now done in subobjects ``response_headers`` or ``request_headers`` (as for option ``dump-all-headers``)
+  instead of at the root of the ``http`` json object (to avoid some collisions).
 
 Deprecations
 ~~~~~~~~~~~~