# Wireshark json file cannot display in separate fields in Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [December 10, 2021, 2:38am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381 "2021-12-10T02:38:23Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![lauyatkin](https://avatars.discourse-cdn.com/v4/letter/l/7bcc69/32.png) [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Post date:** [December 17, 2021, 9:46am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/24 "2021-12-17T09:46:37Z")
I just do a research in the Internet and found out that I can modify the Tshark command to output the result: ```auto .\tshark.exe -i rpcap://x.x.x.x:6666/cali18dd3a4d0a8 -T json -E header=y -E separator=/t -a duration:10 -e frame.time -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e tcp.payload > C:\wireshark\20211217_packets_137.json ``` However, now the json file become like that, that is exactly what I need: ```auto [ { "_index": "packets-2021-12-17", "_type": "doc", "_score": null, "_source": { "layers": { "frame.time": [ "Dec 17, 2021 17:39:18.491701000 China Standard Time" ], "ip.src": [ "10.200.25.98" ], "ip.dst": [ "10.2.0.1" ], "tcp.srcport": [ "51344" ], "tcp.dstport": [ "443" ], "tcp.payload": [ "170303002900000000006f277f3404657b2b8437c7d65021dd854cbfc32a30b315a5dfea728cc12962f81740719b" ] } } }, { "_index": "packets-2021-12-17", "_type": "doc", "_score": null, "_source": { "layers": { "frame.time": [ "Dec 17, 2021 17:39:18.495052000 China Standard Time" ], "ip.src": [ "10.2.0.1" ], "ip.dst": [ "10.200.25.98" ], "tcp.srcport": [ "443" ], "tcp.dstport": [ "51344" ], "tcp.payload": [ "170303003d0000000000a6eb66340bc56ebfd2cfbf21a7ed5ea076e0c409dd23472712160630fe8313561318be39afe353b5dcd2b15b5b5bad3f4f3d4e3f90b35768" ] } } } ] ``` I was thinking how can I modify the configuration to deal with this. There may still the problem with UTF-8 here. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 17, 2021, 3:33pm UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/25 "2021-12-17T15:33:27Z")
Did you just try setting the encoding setting I showed you instead of trying a whole different method? ```auto - type: log enabled: true paths: - 'C:\wireshark\*.json' json.keys_under_root: true json.add_error_key: true encoding : utf-8 ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 17, 2021, 4:31pm UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/26 "2021-12-17T16:31:04Z")
Per the [Wireshark docs](https://www.wireshark.org/docs/man-pages/tshark.html) I would just try the utf-8 setting I showed above... > ## OUTPUT > > **TShark** uses UTF-8 to represent strings internally. In some cases the output might not be valid. For example, a dissector might generate invalid UTF-8 character sequences. Programs reading **TShark** output should expect UTF-8 and be prepared for invalid output. > > If **TShark** detects that it is writing to a TTY on UNIX or Linux and the locale does not support UTF-8, output will be re-encoded to match the current locale. > > If **TShark** detects that it is writing to the console on Windows, dissection output will be encoded as UTF-16LE. Other output will be UTF-8. If extended characters don’t display properly in your terminal you might try setting your console code page to UTF-8 ( **chcp 65001** ) and using a modern terminal application if possible. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 17, 2021, 7:33pm UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/27 "2021-12-17T19:33:57Z")
I installed Wireshark Ran `tshark -i en7 -T ek -a duration:10 > wireshark-test-utf.json` And it ingested fine... I have Mac so perhaps the encoding is a little different, if you just get the right encoding I think you will be fine. If you open your json in something like VSCode it will tell you the encoding in the bottom right. ---
**Author:** ![lauyatkin](https://avatars.discourse-cdn.com/v4/letter/l/7bcc69/32.png) [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Post date:** [December 21, 2021, 1:48am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/28 "2021-12-21T01:48:45Z")
Hello stephen, Would you mind show me your result in screen capture? I would actually confirm if my expected result is right or not. Thank you. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 21, 2021, 1:57am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/29 "2021-12-21T01:57:45Z")
Apologies, I'm not quite sure what you're asking. Do you want to see what the raw data from Wireshark looks like? Do you want to see what it looks like after it's ingested in Kibana I will state. I don't believe I have the encoding issue that you have because I have a simple Mac with US English code set ---
**Author:** ![lauyatkin](https://avatars.discourse-cdn.com/v4/letter/l/7bcc69/32.png) [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Post date:** [December 21, 2021, 1:58am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/30 "2021-12-21T01:58:48Z")
Sorry for misunderstanding, I would like to have a look after the data ingested in Kibana. ---
**Author:** ![lauyatkin](https://avatars.discourse-cdn.com/v4/letter/l/7bcc69/32.png) [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Post date:** [December 21, 2021, 2:31am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/31 "2021-12-21T02:31:43Z")
Hey!! I got it!! It is done!! ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c318f0e1c459184a95689b65ab9ffbd6390c082.png) Thank you, man!! You save my time ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 21, 2021, 2:36am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/32 "2021-12-21T02:36:46Z")
@lauyatkin Awesome! Good to hear But Okay, here's the help we need. When you solve something like this, please put what solved it in this thread so others with the same issue know what fixed it ---
**Author:** ![lauyatkin](https://avatars.discourse-cdn.com/v4/letter/l/7bcc69/32.png) [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Post date:** [December 21, 2021, 2:37am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/33 "2021-12-21T02:37:10Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fdad5ea781bef03e299d3d4719e5b8aaf7f70fcf.png) ---
**Author:** ![lauyatkin](https://avatars.discourse-cdn.com/v4/letter/l/7bcc69/32.png) [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Post date:** [December 21, 2021, 2:38am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/34 "2021-12-21T02:38:42Z")
Yes, I will put a summary on this question. Thanks a lot for the support. I can have my Christmas holiday. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 18, 2022, 2:39am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381/35 "2022-01-18T02:39:30Z")
Closed on January 18, 2022, 2:39am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381.md?page=1)