Logstash parsing error

1

Can someone help me with this error?

Screenshot 2020-12-01 at 15.54.14
Screenshot 2020-12-01 at 15.54.142380×208 202 KB

2

Can you share more details about your setup and configuration?
Might be an issue parsing the json output

3

This seems like an issue parsing an HTTP log containing a content_range element. Suricata 5.0.x and newer will add a content_range object with the following elements (when such a range has been detected):

  • raw
  • start
  • end
  • size

raw is the content range parsed, e.g., "raw":"bytes 0-384/385"
The other members are determined from that so in this case you’d have:
"start":0, "end":38,"size":385

Here’s the JSON object as it would be represented in the HTTP event:
"content_range":{"raw":"bytes 0-384/385","start":0,"end":384,"size":385}