# Missing or "localhost" host field in bro http logs

**URL:** <https://community.zeek.org/t/missing-or-localhost-host-field-in-bro-http-logs/5392>\
**Category:** Zeek\
**Created:** [July 25, 2018, 4:04pm UTC](https://community.zeek.org/t/missing-or-localhost-host-field-in-bro-http-logs/5392 "2018-07-25T16:04:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Federico\_Foschini](https://avatars.discourse-cdn.com/v4/letter/f/b9bd4f/32.png) [@Federico\_Foschini](https://community.zeek.org/u/Federico_Foschini)\
**Post date:** [July 25, 2018, 4:04pm UTC](https://community.zeek.org/t/missing-or-localhost-host-field-in-bro-http-logs/5392/1 "2018-07-25T16:04:09Z")

</div>

Hello,  
I notice that sometimes the field host in a bro-http log is missing or contains localhost as a value.  
How is that possible?

This is an example of a log witth localhost as host:

http.11:00:00-12:00:00.bak.gz:{“ts”:“2018-07-25T11:39:09.440378Z”,“uid”:“CZDkyn2xwPRU17Qm9g”,“id\_orig\_h”:“198.134.154.227”,“id\_orig\_p”:49558,“id\_resp\_h”:“192.168.237.29”,“id\_resp\_p”:8081,“trans\_depth”:3,“method”:“GET”,“host”:“localhost”,“uri”:"/ospos/index.php/login",“version”:“1.1”,“user\_agent”:“Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0”,“request\_body\_len”:0,“response\_body\_len”:0,“status\_code”:500,“status\_msg”:“Internal Server Error”,“tags”:[]}

In this one the host is missing:

http.12:00:00-13:00:00.bak.gz:{“ts”:“2018-07-25T12:09:31.955600Z”,“uid”:“CERXcsevwbBQrqWDf”,“id\_orig\_h”:“192.168.235.47”,“id\_orig\_p”:57326,“id\_resp\_h”:“192.168.50.201”,“id\_resp\_p”:80,“trans\_depth”:2,“request\_body\_len”:0,“response\_body\_len”:0,“tags”:[]}

Is that a normal behavior?

Thanks

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [July 26, 2018, 6:37pm UTC](https://community.zeek.org/t/missing-or-localhost-host-field-in-bro-http-logs/5392/2 "2018-07-26T18:37:05Z")

</div>

> Hello,  
> I notice that sometimes the field host in a bro-http log is missing or contains localhost as a value.  
> How is that possible?
> 
> This is an example of a log witth localhost as host:
> 
> http.11:00:00-12:00:00.bak.gz:{"ts":"2018-07-25T11:39:09.440378Z","uid":"CZDkyn2xwPRU17Qm9g","id\_orig\_h":"198.134.154.227","id\_orig\_p":49558,"id\_resp\_h":"192.168.237.29","id\_resp\_p":8081,"trans\_depth":3,"method":"GET","host":"localhost","uri":"/ospos/index.php/login","version":"1.1","user\_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0","request\_body\_len":0,"response\_body\_len":0,"status\_code":500,"status\_msg":"Internal Server Error","tags":}

There is no default value in bro, so if the log says localhost, it means the request was for localhost.

> In this one the host is missing:
> 
> http.12:00:00-13:00:00.bak.gz:{"ts":"2018-07-25T12:09:31.955600Z","uid":"CERXcsevwbBQrqWDf","id\_orig\_h":"192.168.235.47","id\_orig\_p":57326,"id\_resp\_h":"192.168.50.201","id\_resp\_p":80,"trans\_depth":2,"request\_body\_len":0,"response\_body\_len":0,"tags":}
> 
> Is that a normal behavior?

request\_body\_len and response\_body\_len are both 0, so it looks like the client did something weird here.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/missing-or-localhost-host-field-in-bro-http-logs/5392/3 "2022-05-06T15:45:57Z")

</div>