Parsing input as JSON: invalid character '\x00' looking for beginning of value Filebeat

Elastic Stack Beats
1

Hi everybody!

I made a configuration where the data is imported in Elastic through a pipeline using filebeat. This gives in Discover the following error: parsing input as JSON: invalid character '\x00' looking for beginning of value.

Based on a JSON checker, my JSON file is valid. I de-prettied the file using jq. Can somebody tell me what I am doing wrong?

[{
    "_index": "packets-2015-07-25",
    "_type": "doc",
    "_score": null,
    "_source": {
      "layers": {
        "frame": {
          "frame.encap_type": "1",
          "frame.time": "Jul 25, 2015 17:51:38.669899000 West-Europa (zomertijd)",
          "frame.offset_shift": "0.000000000",
          "frame.time_epoch": "1437839498.669899000",
          "frame.time_delta": "0.861901000",
          "frame.time_delta_displayed": "0.861901000",
          "frame.time_relative": "1.863569000",
          "frame.number": "5",
          "frame.len": "54",
          "frame.cap_len": "54",
          "frame.md5_hash": "06a0c1e671bec06eaa2824cfd42670d3",
          "frame.marked": "0",
          "frame.ignored": "0",
          "frame.file_off": "256",
          "frame.protocols": "eth:ethertype:ip:igmp:igmp",
          "frame.coloring_rule.name": "Routing",
          "frame.coloring_rule.string": "hsrp || eigrp || ospf || bgp || cdp || vrrp || carp || gvrp || igmp || ismp"
        },
        "eth": {
          "eth.dst": "01:00:5e:00:00:16",
          "eth.dst_tree": {
            "eth.dst_resolved": "IPv4mcast_16",
            "eth.dst.oui": "65630",
            "eth.addr": "01:00:5e:00:00:16",
            "eth.addr_resolved": "IPv4mcast_16",
            "eth.addr.oui": "65630",
            "eth.dst.lg": "0",
            "eth.lg": "0",
            "eth.dst.ig": "1",
            "eth.ig": "1"
          },
          "eth.src": "08:00:27:3b:87:ab",
          "eth.src_tree": {
            "eth.src_resolved": "PcsCompu_3b:87:ab",
            "eth.src.oui": "524327",
            "eth.src.oui_resolved": "PCS Computer Systems GmbH",
            "eth.addr": "08:00:27:3b:87:ab",
            "eth.addr_resolved": "PcsCompu_3b:87:ab",
            "eth.addr.oui": "524327",
            "eth.addr.oui_resolved": "PCS Computer Systems GmbH",
            "eth.src.lg": "0",
            "eth.lg": "0",
            "eth.src.ig": "0",
            "eth.ig": "0"
          },
          "eth.type": "0x0800"
        },
        "ip": {
          "ip.version": "4",
          "ip.hdr_len": "24",
          "ip.dsfield": "0x00",
          "ip.dsfield_tree": {
            "ip.dsfield.dscp": "0",
            "ip.dsfield.ecn": "0"
          },
          "ip.len": "40",
          "ip.id": "0x0001",
          "ip.flags": "0x00",
          "ip.flags_tree": {
            "ip.flags.rb": "0",
            "ip.flags.df": "0",
            "ip.flags.mf": "0"
          },
          "ip.frag_offset": "0",
          "ip.ttl": "1",
          "ip.proto": "2",
          "ip.checksum": "0x3a8c",
          "ip.checksum.status": "1",
          "ip.checksum_calculated": "0x3a8c",
          "ip.src": "10.0.0.45",
          "ip.addr": "10.0.0.45",
          "ip.src_host": "10.0.0.45",
          "ip.dst": "224.0.0.22",
          "ip.dst_host": "224.0.0.22",
          "ip.host": "224.0.0.22",
          "Options: (4 bytes), Router Alert": {
            "ip.options.routeralert": "94:04:00:00",
            "ip.options.routeralert_tree": {
              "ip.opt.type": "148",
              "ip.opt.type_tree": {
                "ip.opt.type.copy": "1",
                "ip.opt.type.class": "0",
                "ip.opt.type.number": "20"
              },
              "ip.opt.len": "4",
              "ip.opt.ra": "0"
            }
          }
        }
      }
    }
  }
]
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.