outputpcap
Records the payload field, which is received as an input, as a PCAP file in the specified file system path.
Syntax
outputpcap FILE_PATH
Required Parameter
FILE_PATH
- Path to save the PCAP file
Usage
Store only packets with a destination or source port of 80 while monitoring the stream created by the pcap_stream
log collector for 5 minutes.
logger window=5m localhost\pcap_stream
| pcapdecode
| search src_port==80 or dst_port==80
| outputpcap /opt/logpresso/files/http.pcap