go-pot:

- remove conflicting field ("type")
- ranme duration => session_duration

docker/elk/logstash/dist/http_output.conf

@@ -520,6 +520,9 @@ filter {
     }
     mutate {
       remove_field => ["ts"]
+      rename => {
+        "duration" => "session_duration"
+      }
     }
   }
 

docker/elk/logstash/dist/logstash.conf

@@ -512,6 +512,9 @@ filter {
     }
     mutate {
       remove_field => ["ts"]
+      rename => {
+        "duration" => "session_duration"
+      }
     }
   }
 

docker/go-pot/Dockerfile

@@ -4,9 +4,7 @@ apk -U upgrade
 apk -U add git
 mkdir -p /opt
 cd /opt
-git clone https://github.com/t3chn0m4g3/go-pot
+git clone https://github.com/ryanolee/go-pot -b v1.0.0
-cd go-pot
-git checkout 75a2cae856642fdccf3e9d47d0733cf4190ba70b
 EOF
 WORKDIR /opt/go-pot
 #

docker/go-pot/dist/config.yml

@@ -56,7 +56,7 @@ server:
     #   - device_brand: The type of device of the client (Inferred from the user agent)
     #   - phase: "start" or "end" depending on the phase of the request
     #   - duration: The duration of the request in milliseconds (Only available as a part of the end phase of a request)
-    fields_to_log: "timestamp,id,status,src_ip,method,path,qs,dest_port,type,host,user_agent,browser,browser_version,os,os_version,device,device_brand,phase,duration"
+    fields_to_log: "timestamp,id,status,src_ip,method,path,qs,dest_port,host,user_agent,browser,browser_version,os,os_version,device,device_brand,phase,duration"
 
 # Configuration for logging related settings for go-pot
 logging: