From 1222a0315c82549957fe5fef71d32218175e55f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ensar=20Saraj=C4=8Di=C4=87?= <dev@ensarsarajcic.com>
Date: Fri, 17 Jul 2026 19:54:31 +0200
Subject: [PATCH 1/3] fix(dnstap source): expose parsed httpProtocol field in
 events

Fixes: #25885
---
 lib/vector-vrl/dnstap-parser/src/parser.rs | 28 +++++++++++++++++++++-
 lib/vector-vrl/dnstap-parser/src/schema.rs |  2 ++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/lib/vector-vrl/dnstap-parser/src/parser.rs b/lib/vector-vrl/dnstap-parser/src/parser.rs
index 8f18f3d90e609..4d8d2781abfc3 100644
--- a/lib/vector-vrl/dnstap-parser/src/parser.rs
+++ b/lib/vector-vrl/dnstap-parser/src/parser.rs
@@ -39,7 +39,10 @@ use dnstap_proto::{
 use vector_core::config::log_schema;
 use vector_lookup::{PathPrefix, lookup_v2::ValuePath};
 
-use crate::{internal_events::DnstapParseWarning, schema::DNSTAP_VALUE_PATHS};
+use crate::{
+    internal_events::DnstapParseWarning, parser::dnstap_proto::HttpProtocol,
+    schema::DNSTAP_VALUE_PATHS,
+};
 
 #[derive(Debug, Snafu)]
 enum DnstapParserError {
@@ -239,6 +242,15 @@ impl DnstapParser {
             )?;
         }
 
+        if let Some(http_protocol) = dnstap_message.http_protocol {
+            DnstapParser::insert(
+                event,
+                prefix.clone(),
+                &DNSTAP_VALUE_PATHS.http_protocol,
+                to_http_protocol_name(http_protocol)?.to_string(),
+            );
+        }
+
         DnstapParser::parse_dnstap_message_type(
             event,
             prefix.clone(),
@@ -1014,6 +1026,12 @@ fn to_socket_protocol_name(socket_protocol: i32) -> Result<&'static str> {
         .map(|sp| sp.as_str_name())
 }
 
+fn to_http_protocol_name(http_protocol: i32) -> Result<&'static str> {
+    HttpProtocol::try_from(http_protocol)
+        .map_err(|_| Error::from(format!("Unknown HTTP protocol: {http_protocol}")))
+        .map(|sp| sp.as_str_name())
+}
+
 fn to_dnstap_data_type(data_type_id: i32) -> Option<String> {
     match data_type_id {
         1 => Some(String::from("Message")),
@@ -1448,4 +1466,12 @@ mod tests {
         assert_eq!("DOQ", to_socket_protocol_name(7).unwrap());
         assert!(to_socket_protocol_name(8).is_err());
     }
+
+    #[test]
+    fn test_get_http_protocol_name() {
+        assert_eq!("HTTP1", to_http_protocol_name(1).unwrap());
+        assert_eq!("HTTP2", to_http_protocol_name(2).unwrap());
+        assert_eq!("HTTP3", to_http_protocol_name(3).unwrap());
+        assert!(to_http_protocol_name(4).is_err());
+    }
 }
diff --git a/lib/vector-vrl/dnstap-parser/src/schema.rs b/lib/vector-vrl/dnstap-parser/src/schema.rs
index c2fea507d60e1..b1870d9936ea5 100644
--- a/lib/vector-vrl/dnstap-parser/src/schema.rs
+++ b/lib/vector-vrl/dnstap-parser/src/schema.rs
@@ -223,6 +223,7 @@ pub struct DnstapPaths {
     pub response_message: OwnedValuePath,
     pub request_message_size: OwnedValuePath,
     pub response_message_size: OwnedValuePath,
+    pub http_protocol: OwnedValuePath,
 
     // DnsQueryMessageSchema
     pub response_code: OwnedValuePath,
@@ -325,6 +326,7 @@ pub static DNSTAP_VALUE_PATHS: LazyLock<DnstapPaths> = LazyLock::new(|| DnstapPa
     response_message: owned_value_path!("responseData"),
     request_message_size: owned_value_path!("requestMessageSize"),
     response_message_size: owned_value_path!("responseMessageSize"),
+    http_protocol: owned_value_path!("httpProtocol"),
     response_code: owned_value_path!("fullRcode"),
     response: owned_value_path!("rcodeName"),
     header: owned_value_path!("header"),

From 0179c9af584405736112e1a0f8fd304a1ac50f83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ensar=20Saraj=C4=8Di=C4=87?= <dev@ensarsarajcic.com>
Date: Fri, 17 Jul 2026 19:59:27 +0200
Subject: [PATCH 2/3] Add changelog entry

---
 changelog.d/25887_dnstap_source_http_protocol_field.fix.md | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 changelog.d/25887_dnstap_source_http_protocol_field.fix.md

diff --git a/changelog.d/25887_dnstap_source_http_protocol_field.fix.md b/changelog.d/25887_dnstap_source_http_protocol_field.fix.md
new file mode 100644
index 0000000000000..6f25981b0441f
--- /dev/null
+++ b/changelog.d/25887_dnstap_source_http_protocol_field.fix.md
@@ -0,0 +1,3 @@
+Added missing "httpProtocol" field to dnstap source events.
+
+authors: esensar Quad9DNS

From 493aea679249c37d039e94ef85e4996b0178272c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ensar=20Saraj=C4=8Di=C4=87?= <dev@ensarsarajcic.com>
Date: Fri, 17 Jul 2026 20:56:41 +0200
Subject: [PATCH 3/3] Register http_protocol in source schema

---
 lib/vector-vrl/dnstap-parser/src/schema.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/vector-vrl/dnstap-parser/src/schema.rs b/lib/vector-vrl/dnstap-parser/src/schema.rs
index b1870d9936ea5..28656c6091faa 100644
--- a/lib/vector-vrl/dnstap-parser/src/schema.rs
+++ b/lib/vector-vrl/dnstap-parser/src/schema.rs
@@ -184,6 +184,7 @@ impl DnstapEventSchema {
                 Kind::integer(),
                 None,
             )
+            .optional_field(&DNSTAP_VALUE_PATHS.http_protocol, Kind::bytes(), None)
     }
 
     /// The schema definition for a dns tap message.