# Using tshark -e \ with -T ek switch, parsing json, filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 30, 2019, 11:12pm UTC](https://discuss.elastic.co/t/using-tshark-e-field-with-t-ek-switch-parsing-json-filebeat/183625 "2019-05-30T23:12:48Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![dataGuy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dataguy/32/47503_2.png) [@dataGuy](https://discuss.elastic.co/u/dataGuy)\ **Post date:** [May 30, 2019, 11:12pm UTC](https://discuss.elastic.co/t/using-tshark-e-field-with-t-ek-switch-parsing-json-filebeat/183625/1 "2019-05-30T23:12:48Z")
Thanks for allowing me in the forums I'm new to Elasticstack and this is my first post so please be gentle. Tools: Windows 10.1804 (Admin)PowerShell Elastic Version 7.0.1 Problem: When harvesting a json file generated by using `.\tshark -i eth0 -T ek -e ip.src > somefile.json` - I get an error with FileBeat: `ERROR readjson/json.go:52 Error decoding JSON: invalid character 'ÿ' looking for beginning value` - followed by: `ERROR readjson/json.go:52 Error decoding JSON: invalid character '\x00' looking for beginning value ` the latter occurs in a hanging loop. These are caused by the json.keys\_under\_root. Despite the error data is send to Elasticsearch, however that data contains what looks like white space characters between each character e.g.: `"192.168.0.1" becomes ·[·"·1·9·2·.1·6·9·.0·.1·."·]· "timestamp" becomes ·"·t·i·m·e·s·t·a·m·p·"·` The json file appears to be perfect and is an exact match to when you use: `tshark -i eth0 -T ek > somefile.json` except I'm seeing brackets surround the desired fields to collect which makes me think Elasticsearch may be treating the values as arrays except this doesn't explain the timestamp field. This occurs with json.keys\_under\_root regardless and is put in a message field that shouldn't exist. In my filebeat.yml I do use: ` input: -type: log  json.keys_under_root: true` or I do below to get the other problem: processors:  - decode\_json\_fields:     ["timestamp"], ["ip\_src"]`` I'm open to suggestions this seems like a relevant issue as the data is being generated properly except that it appears it may be trying to treat the values as an array. Either getting tshark to not generate the brackets around the fields which would be best, or some way to get Elasticsearch or FileBeat to handle it would be preferable. Ultimately my goal is to utilize `-e ` switch with the `-T ek` switch. Anything constructive would be appreciated. It is crucial however that I keep pre or post processing to a minimum through the pipeline. I wold prefer not write a parser to handle this. For the sake of the concept I am trying not to use Logstash at this moment but I'm sure Grok could help with this. Regards, dataGuy ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [June 3, 2019, 7:55am UTC](https://discuss.elastic.co/t/using-tshark-e-field-with-t-ek-switch-parsing-json-filebeat/183625/2 "2019-06-03T07:55:07Z")
Your configuration seems incorrect. (Also, when you are sharing config snippets, please format them using ``.) You don't need to set `json.keys_under_root` if you are using the `decode_json_fields` processor. ```auto filebeat.inputs: - type: log enabled: true processors: - decode_json_fields: target: "" ``` Why do you have `"timestamp"` and `"ip_src"` in your configuration? Do you want to process those fields? Could you please share an example log? ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [June 5, 2019, 9:28am UTC](https://discuss.elastic.co/t/using-tshark-e-field-with-t-ek-switch-parsing-json-filebeat/183625/4 "2019-06-05T09:28:36Z")
Could you also share your debug logs when reading the input file from the beginning? (`./filebeat -e -d "*"`) ---
**Author:** ![dataGuy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dataguy/32/47503_2.png) [@dataGuy](https://discuss.elastic.co/u/dataGuy)\ **Post date:** [June 11, 2019, 2:50am UTC](https://discuss.elastic.co/t/using-tshark-e-field-with-t-ek-switch-parsing-json-filebeat/183625/8 "2019-06-11T02:50:54Z")
I've removed most of this message as its being ignored and I won't be monitoring it anymore, if you would like to continue let me know @kvch ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 9, 2019, 2:54am UTC](https://discuss.elastic.co/t/using-tshark-e-field-with-t-ek-switch-parsing-json-filebeat/183625/9 "2019-07-09T02:54:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.