search

sm-biz / paloalto-elasticstack-viz

PANW Firewall Visualisations using Elastic Stack
89 stars 39 forks source link

Make threat_template_mapping-v1.json valid json #5

Closed colakong closed 4 years ago

colakong commented 6 years ago

It doesn't look like threat_template_mapping-v1.json is valid json. It's got an extra } at the end of the file.

It doesn't seem to impact the ability to import it directly into ElasticSearch with a PUT request, but it did give me trouble when I attempted to deploy the file as-is with puppet. (source '} ' not in PSON!)

Steps to reproduce

  1. Check the file

    cat threat_template_mapping-v1.json | jq . > /dev/null

    You should see an error message like parse error: Unmatched '}' at line 721, column 1

  2. Remove the last line

    perl -ne 'print if not eof()' threat_template_mapping-v1.json > threat_template_mapping-v1.json.new && mv threat_template_mapping-v1.json.new threat_template_mapping-v1.json

  3. Check the file again

    cat threat_template_mapping-v1.json | jq . > /dev/null

There should be no error message :)