Suricata

Jason, What is expected here ?
Is this about rules/http2-events.rules ?

Maybe I was wrong, but are the "http" events in "eve.json" changing in format at all?

Maybe I was wrong, but are the "http" events in "eve.json" changing in format at all?

They should have the same info such as http.url or http.http_method

They are extended as we have more http2-specific information

We can recognize them with http.version: "2"

You can check for instance S-V test http2-upgrade

You can check the code in log_http2 with for (name, value) in common {