Wrong phrase in the http.response.phrase field

[NeonSludge]

• Version: Packetbeat 5.5.0
• OS: Red Hat Enterprise Linux Server release 6.7 (Santiago) (Linux 2.6.32-504.8.1.el6.x86_64 I can't install packetbeat #1 SMP Wed Jan 28 21:11:36 UTC 2015)
• Steps to reproduce: parse an HTTP 500 or HTTP 404 response with Packetbeat and inspect the http.response.phrase field in the produced event.

It appears that Packetbeat 5.5.0 (the HTTP module) only gets the last word from HTTP status line when searching for the response phrase (i.e. HTTP/1.1 404 Not Found turns into "Found" in the http.response.phrase field). More details are available in this forum post.

Examples of HTTP response headers and status lines that produce wrong http.response.phrase values:

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 949
Date: Mon, 31 Jul 2017 11:31:53 GMT

HTTP/1.1 500 Internal Server Error
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 3739
Date: Mon, 31 Jul 2017 11:33:28 GMT
Connection: close