diff options
| author | Martin Kacer <kacer.martin@gmail.com> | 2016-06-13 15:47:44 +0200 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2016-06-17 06:09:29 +0000 |
| commit | 42b060905e6a84c1413803e59766802089f6349d (patch) | |
| tree | 2eec8bc60f00414ab720776ab226f87ced48ade1 /doc | |
| parent | 0aa5f6c6c70959c24caee61a88889b1b86d610f1 (diff) | |
tshark JSON and Elasticsearch output
Added ouput -T for json|ek
Added -j switch fo filter EK json|ek fields.
Added -x switch to work with json|ek to insert raw fields.
Bug: 11754
Change-Id: Iad5a9092b843c074b0b774d1745fa14fca09f6b7
Reviewed-on: https://code.wireshark.org/review/15869
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/tshark.pod | 28 |
1 files changed, 26 insertions, 2 deletions
diff --git a/doc/tshark.pod b/doc/tshark.pod index 120c74514a..2ee54edbc3 100644 --- a/doc/tshark.pod +++ b/doc/tshark.pod @@ -22,6 +22,7 @@ S<[ B<-g> ]> S<[ B<-h> ]> S<[ B<-H> E<lt>input hosts fileE<gt> ]> S<[ B<-i> E<lt>capture interfaceE<gt>|- ]> +S<[ B<-j> E<lt>json match filterE<gt> ]> S<[ B<-I> ]> S<[ B<-K> E<lt>keytabE<gt> ]> S<[ B<-l> ]> @@ -39,7 +40,7 @@ S<[ B<-R> E<lt>Read filterE<gt> ]> S<[ B<-s> E<lt>capture snaplenE<gt> ]> S<[ B<-S> E<lt>separatorE<gt> ]> S<[ B<-t> a|ad|adoy|d|dd|e|r|u|ud|udoy ]> -S<[ B<-T> fields|pdml|ps|psml|text ]> +S<[ B<-T> ek|fields|json|pdml|ps|psml|text ]> S<[ B<-u> E<lt>seconds typeE<gt>]> S<[ B<-U> E<lt>tap_nameE<gt>]> S<[ B<-v> ]> @@ -534,6 +535,14 @@ If used after an B<-i> option, it enables the monitor mode for the interface specified by the last B<-i> option occurring before this option. +=item -j E<lt>json match filterE<gt> + +JSON match filter used for json|ek output file types. +JSON parent node containing multiple child nodes is only included, +if the name is found in the filter. + +Example: B<-j "http tcp ip"> + =item -K E<lt>keytabE<gt> Load kerberos crypto keys from the specified keytab file. @@ -724,11 +733,19 @@ was captured The default format is relative. -=item -T fields|pdml|ps|psml|text +=item -T ek|fields|json|pdml|ps|psml|text Set the format of the output when viewing decoded packet data. The options are one of: +B<ek> Newline delimited JSON format for bulk import into Elasticsearch. +It can be used with B<-j> including the JSON filter or with B<-x> flag +to include raw packet data. +Example of usage to import data into Elasticsearch: + + tshark -T ek -j "http tcp ip" -x -r file.pcap > file.json + curl -XPUT http://elasticsearch:9200/_bulk --data-binary @file.json + B<fields> The values of fields specified with the B<-e> option, in a form specified by the B<-E> option. For example, @@ -737,6 +754,13 @@ form specified by the B<-E> option. For example, would generate comma-separated values (CSV) output suitable for importing into your favorite spreadsheet program. +B<json> JSON file format. It can be used with B<-j> including +the JSON filter or with B<-x> flag to influde raw packet data. +Example of usage: + + tshark -T json -r file.pcap + tshark -T json -j "http tcp ip" -x -r file.pcap + B<pdml> Packet Details Markup Language, an XML-based format for the details of a decoded packet. This information is equivalent to the packet details printed with the B<-V> flag. |