outputpcap

Records the payload field, which is received as an input, as a PCAP file in the specified file system path.

Syntax

outputpcap FILE_PATH
Required Parameters
FILE_PATH
Path to save the PCAP file

Usage

Store only packets with a destination or source port of 80 while monitoring the stream created by the pcap_stream log collector for 5 minutes.

logger window=5m localhost\pcap_stream
| pcapdecode
| search src_port==80 or dst_port==80
| outputpcap /opt/logpresso/files/http.pcap