elastic / elastic/stream

Misleading logging of requests

Open
#194 1 comment 0 reactions 0 assignees View on GitHub
bug Team:Security-Service Integrations
Dominant language
Go
Stars
12
Forks
18
Avg merge
10h 32m
Merged PRs (30d)
1

Description

While trying to write config to mock an OAuth token endpoint, Stream logs the following miss, showing a query string:
```json
{
"level": "debug",
"ts": "2026-02-26T15:36:45.481Z",
"caller": "httpserver/httpserver.go:58",
"msg": "request did not match with any rule: Request path: POST /test-tenant-id/oauth2/v2.0/token?grant_type=client_credentials&scope=http%3A%2F%2Fsvc-graph-api%3A8080%2F.default, Request Headers: 'Authorization: [Basic dGVzdC1jbGllbnQtaWQ6dGVzdC1jbGllbnQtc2VjcmV0]' 'Content-Type: [application/x-www-form-urlencoded]' 'Accept-Encoding: [gzip]' 'Connection: [close]' 'User-Agent: [Go-http-client/1.1]' 'Content-Length: [80]' , Request Body: ",
"address": ":8080"
}
```

However, there was no query string. That data was in the request body, not the query string.

Here's the log for the same request in CEL input request tracing:
```json
{
"log.level": "debug",
"@timestamp": "2026-02-26T15:36:45.480Z",
"message": "HTTP request",
"transaction.id": "4U9CM4NGQMBHG-1",
"url.original": "http://svc-graph-api:8080/test-tenant-id/oauth2/v2.0/token",
"url.scheme": "http",
"url.path": "/test-tenant-id/oauth2/v2.0/token",
"url.domain": "svc-graph-api",
"url.port": "8080",
"url.query": "",
"http.request.method": "POST",
"http.request.header": {
"Authorization": [
"Basic dGVzdC1jbGllbnQtaWQ6dGVzdC1jbGllbnQtc2VjcmV0"
],
"Content-Type": [
"application/x-www-form-urlencoded"
]
},
"user_agent.original": "",
"http.request.body.content": "grant_type=client_credentials&scope=http%3A%2F%2Fsvc-graph-api%3A8080%2F.default",
"http.request.body.truncated": false,
"http.request.body.bytes": 80,
"http.request.mime_type": "application/x-www-form-urlencoded",
"ecs.version": "1.6.0"
}
```

Stream should log what's actually happening, with a correct query string (empty in this case), not rewrite the body as a query string.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.