fix incorrectly handle with two-words redis command

CHANGELOG.next.asciidoc

@@ -74,6 +74,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 - Add support for mongodb opcode 2013 (OP_MSG). {issue}6191[6191] {pull}8594[8594]
 - NFSv4: Always use opname `ILLEGAL` when failed to match request to a valid nfs operation. {pull}11503[11503]
+- Redis: fix incorrectly handle with two-words redis command. {issue}14872[14872] {pull}14873[14873] 
 
 *Winlogbeat*
 

packetbeat/protos/redis/redis_parse.go

@@ -19,6 +19,7 @@ package redis
 
 import (
 	"time"
+	"bytes"
 
 	"github.com/elastic/beats/libbeat/common"
 	"github.com/elastic/beats/libbeat/common/streambuf"
@@ -423,7 +424,7 @@ func (p *parser) parseArray(depth int, buf *streambuf.Buffer) (common.NetString,
 	}
 
 	// handle top-level request command
-	if depth == 0 && isRedisCommand(content[0]) {
+	if depth == 0 && (isRedisCommand(content[0]) || (count > 1 && isRedisCommand(bytes.Join(content[0:2], []byte(" "))))) {
 		p.message.isRequest = true
 		p.message.method = content[0]
 		if len(content) > 1 {

packetbeat/protos/redis/redis_test.go

@@ -70,6 +70,24 @@ func TestRedisParser_ArrayRequest(t *testing.T) {
 	assert.Equal(t, len(arrayRequest), msg.size)
 }
 
+var arrayRequest2 = []byte("*3\r\n" +
+        "$6\r\n" +
+	"CONFIG\r\n" +
+	"$3\r\n" +
+	"GET\r\n" +
+	"$1\r\n" +
+	"*\r\n")
+
+func TestRedisParser_ArrayRequest2(t *testing.T) {
+	msg, ok, complete := parse(arrayRequest2)
+
+	assert.True(t, ok)
+	assert.True(t, complete)
+	assert.True(t, msg.isRequest)
+	assert.Equal(t, "CONFIG GET *", string(msg.message))
+	assert.Equal(t, len(arrayRequest2), msg.size)
+}
+
 var arrayResponse = []byte("*4\r\n" +
 	"$3\r\n" +
 	"foo\r\n" +