From: Eric Leblond Date: Wed, 28 Jun 2017 11:56:43 +0000 (+0200) Subject: doc: document http-body logging X-Git-Tag: suricata-4.0.0-rc1~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2819%2Fhead;p=thirdparty%2Fsuricata.git doc: document http-body logging --- diff --git a/doc/userguide/output/eve/eve-json-output.rst b/doc/userguide/output/eve/eve-json-output.rst index c39432b272..8dce34994f 100644 --- a/doc/userguide/output/eve/eve-json-output.rst +++ b/doc/userguide/output/eve/eve-json-output.rst @@ -163,6 +163,8 @@ Metadata:: # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) + # http-body: yes # enable dumping of http body in Base64 + # http-body-printable: yes # enable dumping of http body in printable format metadata: yes # add L7/applayer fields, flowbit and other vars to the alert Alternatively to the `metadata` key it is also possible to select the application