As of February 2016 release, Bro IDS Host Name has been added as an installation parameter, and no longer has to be configured separately.
Yes, I'm seeing the same occurrences. I can empathize though having gone through the effort of creating a flex connector for Bro. Bro has done some good things by breaking out the various parts of a URL but in this case it would be better to have it complete vice parsed. As to the hyphens in the data, they are both a benefit and a nuisance. While it is good to know sometimes that there was nothing in a specific column, it raises havoc when you try to tell the flex connector a certain column is an IP address and then a "-" shows up.....
While it is always good to have accuracy in data (requestUrl in this case), I will settle for all the necessary data being present vice exactly correct.
With the new connector version, I am more concerned with not being able to have the connector continue to follow the Bro log folder after it rotates the logs. I am currently having to re-start the connector on an hourly basis (the same interval Bro creates new log files) in order for the connector to continue finding the log files. I don't understand why this is an issue since the Multi-Folder Flex connector I created followed the folders fine. So the mechanism to do this must exist in the connector bag of goodies. I just need to know the magic configuration to make it work.
While I see the request fields are now populating with data, the Request URL field does not appear to be parsing correctly. It is duplicating some of the URL and in some cases, it leaves the "-" (found in bro's logs for blank fields). Examples:
Larry, are you seeing this as well?
It appears the RequestUrl field is not being populated correctly. The requestProtocol, requestUrlAuthority,requestUrlHost, requestUrlPort, requestUrlFilename, and requestUrlQuery are all populated from a correctly formatted requestUrl: <protocol>://<authority>@<host>:<port>/<filename>?<query>. (per ArcSight dcumentation).