Use JSON as input for Packetbeat

Elastic Stack Beats
1

I am trying to use packetbeat to view a pcap file in Kibana. I have converted my pcap file into json because I know that is the type of file that packetbeat can take in. I used the command:

C:\Program Files\Packetbeat>.\packetbeat.exe -e -I pcaptestfiles/pcaptest2.json -E packetbeat.interfaces.device=any

but when I run the command it soon says Exiting: sniffer loop failed: failed to start sniffer: unknown file format

Any ideas on how to solve this?

2

From where you got this information? Packetbeat capture packets from your network interface or you can run it using the command line to read a pcap file, not a json as you can see in the documentation.

-I, --I FILE
Reads packet data from the specified file instead of reading packets from the network. This option is useful only for testing Packetbeat.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.