# Another zeek.http log question

**URL:** <https://community.zeek.org/t/another-zeek-http-log-question/7163>\
**Category:** Zeek\
**Tags:** training\
**Created:** [October 6, 2023, 10:15am UTC](https://community.zeek.org/t/another-zeek-http-log-question/7163 "2023-10-06T10:15:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gnr23](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@Gnr23](https://community.zeek.org/u/Gnr23)\
**Post date:** [October 6, 2023, 10:15am UTC](https://community.zeek.org/t/another-zeek-http-log-question/7163/1 "2023-10-06T10:15:11Z")

</div>

I have set up a basic home lab with Zeek VM (Ubuntu) with an elastic zeek agent, Win11 victim machine and ParrotOS.  
I have set up a simple python server in Win11 VM and created some http traffic from ParrotOS (requesting files, nmap / nikto/zap scanning).  
My server was recording all this traffic.  
When I try to search for this in Elastic by using for example event.log : zeek.http there is nothing.  
If I search by source IP or destination IP I can clearly detect the traffic from and to my python server.  
But when I expand in elastic these events I can’t see the zeek.http. Any hints?

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [October 9, 2023, 7:31am UTC](https://community.zeek.org/t/another-zeek-http-log-question/7163/2 "2023-10-09T07:31:19Z")

</div>

Hey @Gnr23 - please share a few entries of the full conn.log (if needed with IPs anonymized). There may be something off with your capture setup and missing\_bytes, history, or conn\_state may give an indication of that.

Thanks,  
Arne

---

<div class="post-metadata">

**Author:** ![Gnr23](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@Gnr23](https://community.zeek.org/u/Gnr23)\
**Post date:** [October 9, 2023, 2:25pm UTC](https://community.zeek.org/t/another-zeek-http-log-question/7163/3 "2023-10-09T14:25:50Z")

</div>

OK - my bad. I had reinstalled the zeek VM but I had forgotten to set the second networkd adapter in promiscuous mode:P Thanks for the reply