While trying to write config to mock an OAuth token endpoint, Stream logs the following miss, showing a query string:
{
"level": "debug",
"ts": "2026-02-26T15:36:45.481Z",
"caller": "httpserver/httpserver.go:58",
"msg": "request did not match with any rule: Request path: POST /test-tenant-id/oauth2/v2.0/token?grant_type=client_credentials&scope=http%3A%2F%2Fsvc-graph-api%3A8080%2F.default, Request Headers: 'Authorization: [Basic dGVzdC1jbGllbnQtaWQ6dGVzdC1jbGllbnQtc2VjcmV0]' 'Content-Type: [application/x-www-form-urlencoded]' 'Accept-Encoding: [gzip]' 'Connection: [close]' 'User-Agent: [Go-http-client/1.1]' 'Content-Length: [80]' , Request Body: ",
"address": ":8080"
}However, there was no query string. That data was in the request body, not the query string.
Here's the log for the same request in CEL input request tracing:
{
"log.level": "debug",
"@timestamp": "2026-02-26T15:36:45.480Z",
"message": "HTTP request",
"transaction.id": "4U9CM4NGQMBHG-1",
"url.original": "http://svc-graph-api:8080/test-tenant-id/oauth2/v2.0/token",
"url.scheme": "http",
"url.path": "/test-tenant-id/oauth2/v2.0/token",
"url.domain": "svc-graph-api",
"url.port": "8080",
"url.query": "",
"http.request.method": "POST",
"http.request.header": {
"Authorization": [
"Basic dGVzdC1jbGllbnQtaWQ6dGVzdC1jbGllbnQtc2VjcmV0"
],
"Content-Type": [
"application/x-www-form-urlencoded"
]
},
"user_agent.original": "",
"http.request.body.content": "grant_type=client_credentials&scope=http%3A%2F%2Fsvc-graph-api%3A8080%2F.default",
"http.request.body.truncated": false,
"http.request.body.bytes": 80,
"http.request.mime_type": "application/x-www-form-urlencoded",
"ecs.version": "1.6.0"
}Stream should log what's actually happening, with a correct query string (empty in this case), not rewrite the body as a query string.
While trying to write config to mock an OAuth token endpoint, Stream logs the following miss, showing a query string:
{ "level": "debug", "ts": "2026-02-26T15:36:45.481Z", "caller": "httpserver/httpserver.go:58", "msg": "request did not match with any rule: Request path: POST /test-tenant-id/oauth2/v2.0/token?grant_type=client_credentials&scope=http%3A%2F%2Fsvc-graph-api%3A8080%2F.default, Request Headers: 'Authorization: [Basic dGVzdC1jbGllbnQtaWQ6dGVzdC1jbGllbnQtc2VjcmV0]' 'Content-Type: [application/x-www-form-urlencoded]' 'Accept-Encoding: [gzip]' 'Connection: [close]' 'User-Agent: [Go-http-client/1.1]' 'Content-Length: [80]' , Request Body: ", "address": ":8080" }However, there was no query string. That data was in the request body, not the query string.
Here's the log for the same request in CEL input request tracing:
{ "log.level": "debug", "@timestamp": "2026-02-26T15:36:45.480Z", "message": "HTTP request", "transaction.id": "4U9CM4NGQMBHG-1", "url.original": "http://svc-graph-api:8080/test-tenant-id/oauth2/v2.0/token", "url.scheme": "http", "url.path": "/test-tenant-id/oauth2/v2.0/token", "url.domain": "svc-graph-api", "url.port": "8080", "url.query": "", "http.request.method": "POST", "http.request.header": { "Authorization": [ "Basic dGVzdC1jbGllbnQtaWQ6dGVzdC1jbGllbnQtc2VjcmV0" ], "Content-Type": [ "application/x-www-form-urlencoded" ] }, "user_agent.original": "", "http.request.body.content": "grant_type=client_credentials&scope=http%3A%2F%2Fsvc-graph-api%3A8080%2F.default", "http.request.body.truncated": false, "http.request.body.bytes": 80, "http.request.mime_type": "application/x-www-form-urlencoded", "ecs.version": "1.6.0" }Stream should log what's actually happening, with a correct query string (empty in this case), not rewrite the body as a query string.