adding fields to HTTP log - cluster environment

Hi everyone,

I am trying to add a new field to HTTP log.

I want to check if orig_h is in a table, if true then add the value from that table to the record.

I have a script that works in a single bro instance, but does not work in a cluster environment:

@load base/protocol/http

redef record HTTP::Info += {

field: string &log &optional;


event http_message_done(c: connection, is_orig: bool, stat: http_message_stat)

if ( c$http$id$orig_h in test_table )

c$http$field = test_table[c$http$id$orig_h];



I am not sure why this script works with bro in a single instance mode but not in cluster mode.

Also, giving a higher priority to http_message_done event will override the actual event in main.bro under http ?



Do you have “test_table” set as “&synchronized”?


my mistake, another script ran and removed the default fields on HTTP :slight_smile:

Thanks anyways