# Help with http\_entity\_data script

**URL:** <https://community.zeek.org/t/help-with-http-entity-data-script/2929>\
**Category:** Zeek\
**Created:** [December 6, 2013, 4:29am UTC](https://community.zeek.org/t/help-with-http-entity-data-script/2929 "2013-12-06T04:29:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![scottie](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@scottie](https://community.zeek.org/u/scottie)\
**Post date:** [December 6, 2013, 4:29am UTC](https://community.zeek.org/t/help-with-http-entity-data-script/2929/1 "2013-12-06T04:29:07Z")

</div>

I have this script:

event http\_entity\_data(c: connection, is\_orig: bool, length: count, data: string)  
{  
if ( c$http$method == “GET” && /.seek.com.au/ in c$http$host && /^/Jobsearch?=/ in c$http$uri )  
{  
print fmt("%s", c$http$host);  
}  
}

It doesn’t print anything running this command:  
bro -r seek.pcap seek.bro  
All i get back is a whole bunch of these(bro 2.1):  
ERROR: 1386300192.418090 field value missing [c$http$method] (./seek.bro, line 4)

If i run the same command on my local box(bro 2.2) i get a whole bunch of these:  
1386301933.432853 expression error in ./seek.bro, line 4: field value missing [c$http$method]

If i remove the first bit of the if statement “c$http$method == “GET” &&” i still get errors:  
ERROR: 1386300192.418090 field value missing [c$http$host] (./seek.bro, line 4)

If i just run it through bro with:  
bro -r seek.pcap local.bro

In the http.log its missing the method, host, uri, referrer, and user\_agent, even though the method, host and uri are clearly in the pcap:  
1386301933.281650 CJa1U94yRhXVPIdPde 10.1.40.137 44393 202.58.38.95 80 0 - - - - - 0 235 302 Found - - - (empty) - - – - FYPqLs2ezZWfT428fi text/html

Been stuck on this for a while, any ideas?  
I’ve been using Scott Runnels Youtube tutorial for reference: [http://ryesecurity.blogspot.com.au/2013/01/logging-youtube-titles-with-bro-1-its.html](http://ryesecurity.blogspot.com.au/2013/01/logging-youtube-titles-with-bro-1-its.html)

Here’s the pcap if you need to try to replicate it:  
[https://www.dropbox.com/s/tndo4cahlp7lq66/seek.pcap](https://www.dropbox.com/s/tndo4cahlp7lq66/seek.pcap)

Scott

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 6, 2013, 4:53am UTC](https://community.zeek.org/t/help-with-http-entity-data-script/2929/2 "2013-12-06T04:53:19Z")

</div>

I didn't try your pcap but I don't think I need to. It looks like you have bad checksums. Run Bro with the -C flag.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/help-with-http-entity-data-script/2929/3 "2022-05-06T15:41:26Z")

</div>