redef record HTTP::Info += { content_type: string &log &optional; }; event http_header(c: connection, is_orig: bool, name: string, value: string) { if ( name == "CONTENT-TYPE" ) c$http$content_type = value; }