Post processing of Http events to more specific protocols

[NimrodAvni78]

Many protocols are built on top of http, like the ones used for graphql, elasticseach, s3, sqs and more

What Im suggesting trying to narrow down a Http span into a more specific type of span (like those above)
this can be done with simple post processing of http events in userspace.
it should be configurable, because this will need to rely on some heuristics like:

• port numbers (9200 is probably elastic)
• route conventions ( /.../_search is probably an elastic search query)
• common headers (x-amz-content-sha256 will probably be included in requests to aws s3 / sqs)
  and maybe more

let me know if you have any thoughts regarding specific concerns in the implementations, because i think it can definitely bring a lot of value.

[grcevski]

Sounds like a great idea! We've seen this in the past also with HTTP based sql queries, or JSON RPC. If we send buffers from eBPF space for HTTP requests we can do this kind of processing.