# adding fields to HTTP log - cluster environment

**URL:** <https://community.zeek.org/t/adding-fields-to-http-log-cluster-environment/4722>\
**Category:** Zeek\
**Created:** [March 12, 2017, 12:56pm UTC](https://community.zeek.org/t/adding-fields-to-http-log-cluster-environment/4722 "2017-03-12T12:56:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [March 12, 2017, 12:56pm UTC](https://community.zeek.org/t/adding-fields-to-http-log-cluster-environment/4722/1 "2017-03-12T12:56:37Z")

</div>

Hi everyone,

I am trying to add a new field to HTTP log.

I want to check if orig\_h is in a table, if true then add the value from that table to the record.

I have a script that works in a single bro instance, but does not work in a cluster environment:

@load base/protocol/http

redef record HTTP::Info += {

field: string &log &optional;

}

event http\_message\_done(c: connection, is\_orig: bool, stat: http\_message\_stat)  
{

if ( c$http$id$orig\_h in test\_table )  
{

c$http$field = test\_table[c$http$id$orig\_h];

}

}

I am not sure why this script works with bro in a single instance mode but not in cluster mode.

Also, giving a higher priority to http\_message\_done event will override the actual event in main.bro under http ?

thanks

B

---

<div class="post-metadata">

**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\
**Post date:** [March 12, 2017, 4:03pm UTC](https://community.zeek.org/t/adding-fields-to-http-log-cluster-environment/4722/2 "2017-03-12T16:03:17Z")

</div>

Do you have “test\_table” set as “&synchronized”?

---

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [March 13, 2017, 2:00pm UTC](https://community.zeek.org/t/adding-fields-to-http-log-cluster-environment/4722/3 "2017-03-13T14:00:37Z")

</div>

Hi,

my mistake, another script ran and removed the default fields on HTTP 🙂

Thanks anyways

B

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/adding-fields-to-http-log-cluster-environment/4722/4 "2022-05-06T15:44:44Z")

</div>