search

mushorg / tanner

He who flays the hide
GNU General Public License v3.0
222 stars 104 forks source link

JSON parse error #408

Closed unresolvedhost closed 2 years ago

unresolvedhost commented 3 years ago

Hi, I'm having trouble parsing "tanner_report.json" file with logstash it fails with the following error Here is the configuration file that I'm using (https://github.com/telekom-security/tpotce/blob/master/docker/elk/logstash/dist/logstash.conf)

Logstash version: logstash 7.12.1

[ERROR] 2021-05-08 10:05:30.310 [[main]<file] json - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Invalid FieldReference: 0x[]>, :data=>"{"method": "POST", "path": "/", "headers": {"host": "54.90.21.149", "user-agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36", "accept-encoding": "gzip, deflate", "accept": "/", "connection": "keep-alive", "content-length": "20", "content-type": "application/x-www-form-urlencoded"}, "uuid": "f79d9391-3271-4c5c-a795-be3f5000eb8f", "peer": {"ip": "160.177.125.92", "port": 64174}, "status": 200, "post_data": {"0x[]": "androxgh0st"}, "cookies": {"sess_uuid": null}, "response_msg": {"version": "0.6.0", "response": {"message": {"detection": {"name": "unknown", "order": 0, "type": 1, "version": "0.6.0"}, "sess_uuid": "d2e2823e-e8ca-4f7b-ba91-fa880df013e0"}}}, "timestamp": "2021-05-07T23:56:36.467915"}"}

mzfr commented 3 years ago

@RichardPhilipsRoy I think you should change the codec from json to json_lines.

mzfr commented 3 years ago

@RichardPhilipsRoy Did the fix work? If yes then please close this issue.