elif event in ("tcpopen", "tcpclose"):
decode_client(words, 0)
- return f"{timestamp} {event} " + " ".join(words)
+ # Reconstitute "data" (i.e. everything after the timestamp and the
+ # event) from "words", which was originally obtained by splitting
+ # "data".
+ data = " ".join(words)
+ return f"{timestamp} {event} {data}"