Shouldn't we tested against the http.request event instead? I am amusing the <url> in the last line means event_type.