This script gives analysts the ability to peek into what is being sent in HTTP POST bodies. It provides this by simply extending the HTTP log.
zkg refresh zkg install corelight/log-add-http-post-bodies
The HTTP log will have a new field named post_body which will be populated with a configurable amount of data from the beginning of every seen POST body.