Skip to content

Elasticsearch: support for version >= 5

George Hopkins requested to merge george-hopkins/wireshark:elasticsearch into master

This MR adds support for newer versions of Elasticsearch:

  • Thread context (>= 5)
  • Feature list (>= 6.3)
  • Variable header size (>= 7.6)

The change was tested with the captures from #15324 (closed) as well as the current release (7.9.1).

Questions:

  • At the moment, request and response headers use the same tree for the decoded keys and values. It would not be possible to filter by request/response headers specifically. Note that it is possible (at least in theory) to have request and response headers in the same message. Should we create dedicated items for these key-value pairs?
  • In some cases a response contains no payload. Should we skip adding the item in this case? (Without the patch, a warning is generated because -1 can not be used if the remaining length is 0.)

Fixes #15324 (closed)

Edited by AndersBroman

Merge request reports