# Suricata 6.0.0 rc1 JSON structure

**URL:** <https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604>\
**Category:** Help\
**Created:** [September 15, 2020, 7:59am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604 "2020-09-15T07:59:17Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [September 15, 2020, 7:59am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/1 "2020-09-15T07:59:17Z")

</div>

Hi,

i think only with fileinfo.

**Suricata 5.x:**

**cat eve.json | jq -c 'select(.fileinfo)|.fileinfo.filename’**

“/project.aspx”  
“/project.aspx”  
“/project.aspx”  
“/a.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/db.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“zest2.cab”  
“/project.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/db.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”  
“/bounce.aspx”

**Suricata 6.0.0 rc1**

**cat eve.json | jq -c 'select(.fileinfo)|.fileinfo.filename’**

jq: error (at :10): Cannot index array with string “filename”  
jq: error (at :11): Cannot index array with string “filename”  
jq: error (at :12): Cannot index array with string “filename”  
“16OMZLLAZ.exe”  
“/raw”  
“/ono72/DESKTOP-GNJ751U\_W10019041.319D0542A2FF74DAB56247F5C17738F9/83/”  
“/ono72/DESKTOP-GNJ751U\_W10019041.319D0542A2FF74DAB56247F5C17738F9/81/”  
“/ono72/DESKTOP-GNJ751U\_W10019041.319D0542A2FF74DAB56247F5C17738F9/90”  
jq: error (at :62): Cannot index array with string “filename”  
jq: error (at :63): Cannot index array with string “filename”  
jq: error (at :64): Cannot index array with string “filename”  
“/images/shortwave.png”  
jq: error (at :68): Cannot index array with string “filename”  
jq: error (at :69): Cannot index array with string “filename”  
“/images/longrip.png”  
jq: error (at :73): Cannot index array with string “filename”  
“/images/shortwave.png”  
“/ono72/DESKTOP-GNJ751U\_W10019041.319D0542A2FF74DAB56247F5C17738F9/81/”

**cat eve.json | jq .fileinfo.stored**

null  
true  
null  
null  
null  
jq: error (at :62): Cannot index array with string “stored”  
jq: error (at :63): Cannot index array with string “stored”  
jq: error (at :64): Cannot index array with string “stored”  
true  
null  
null  
jq: error (at :68): Cannot index array with string “stored”  
jq: error (at :69): Cannot index array with string “stored”  
true  
null  
null  
jq: error (at :73): Cannot index array with string “stored”  
true  
null  
null  
null  
null

cat eve.json | jq -c ‘select(.fileinfo)|.fileinfo.stored’

jq: error (at :10): Cannot index array with string “stored”  
jq: error (at :11): Cannot index array with string “stored”  
jq: error (at :12): Cannot index array with string “stored”  
true  
true  
true  
true  
true  
jq: error (at :62): Cannot index array with string “stored”  
jq: error (at :63): Cannot index array with string “stored”  
jq: error (at :64): Cannot index array with string “stored”  
true  
jq: error (at :68): Cannot index array with string “stored”

**cat eve.json | ag fileinfo | jq ‘select(.app\_proto==“http”) | .fileinfo.sha256’ | tr -d ‘"’ | awk ‘{print “./files/“substr($0,0,2)”/”$0}’ | xargs -I{} file {} | colout ‘._:’ green | colout 'PE32._’ red | colout ‘._Cabinet._’ red**  
jq: error (at :1): Cannot index array with string “sha256”  
jq: error (at :2): Cannot index array with string “sha256”  
jq: error (at :3): Cannot index array with string “sha256”  
jq: error (at :9): Cannot index array with string “sha256”  
jq: error (at :10): Cannot index array with string “sha256”  
jq: error (at :11): Cannot index array with string “sha256”  
jq: error (at :13): Cannot index array with string “sha256”  
jq: error (at :14): Cannot index array with string “sha256”  
jq: error (at :16): Cannot index array with string “sha256”  
./files/71/71d3d6fd849274d43a7d9fd4e0011ad24d15a9c5cb57bbb0dc0eda933c397593: PE32 executable (GUI) Intel 80386, for MS Windows  
./files/40/40a58618cb697f749cd36c822c3dff37099016d24102ad127d52c08f06fe3249: ASCII text, with no line terminators  
./files/c7/c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1: ASCII text, with no line terminators  
./files/c7/c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1: ASCII text, with no line terminators  
./files/c7/c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1: ASCII text, with no line terminators  
./files/5e/5e4991ae0dadaf490182b54b98a2e5f4957b7d5e6f0f7d42d4448a795625f9c1: PE32 executable (GUI) Intel 80386, for MS Windows  
./files/34/343124b9ebf869bd9f0b1d7a85b59256a227d27b89b221f22479ba678098a4b8: PE32 executable (GUI) Intel 80386, for MS Windows  
./files/38/3839be21f85ae3918745ff7fe4bef17125d5ae650eaf7fa5bfc98ef4021e1b30: PE32 executable (GUI) Intel 80386, for MS Windows  
./files/c7/c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1: ASCII text, with no line terminators

Thanks

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [September 15, 2020, 8:12am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/2 "2020-09-15T08:12:22Z")

</div>

Are you able to (privately) share the pcap and/or the eve.json file?

---

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [September 15, 2020, 8:23am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/3 "2020-09-15T08:23:26Z")

</div>

you already have eve.json

Tanks

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [September 15, 2020, 8:34am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/4 "2020-09-15T08:34:17Z")

</div>

It looks like this is caused by the `.fileinfo` addition into alerts, where its an array of `fileinfo` records instead of a simple map with a single record.

@ish @Jeff_Lucovsky any ideas on this?

---

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [September 15, 2020, 8:36am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/5 "2020-09-15T08:36:41Z")

</div>

In the versions of Suricata 5.x there was no problem with this as you will have seen in the last captures that I have sent you.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 15, 2020, 11:54am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/6 "2020-09-15T11:54:28Z")

</div>

> [@suricatalfon](#):
>
> **cat eve.json | jq -c 'select(.fileinfo)|.fileinfo.filename’**

Try ` cat eve.json|jq -c 'select(.event_type=="fileinfo").fileinfo.filename'`

In 6.0.0, alerts now contain `fileinfo` information. Since you’re after the `fileinfo` records, first, filter on that (`event_type=="fileinfo"`) and then access the object.

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [September 15, 2020, 11:55am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/7 "2020-09-15T11:55:30Z")

</div>

That is a workaround for the report, but I think the bigger question if we should have a `.fileinfo` that can be both a map and an array.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 15, 2020, 11:58am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/8 "2020-09-15T11:58:42Z")

</div>

An array seems most appropriate, at least for the alert since there can be multiple “file” objects to report.

---

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [September 15, 2020, 12:15pm UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/9 "2020-09-15T12:15:01Z")

</div>

Thanks 😉

 ![Captura de pantalla de 2020-09-15 14-13-25](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/55fd7b62fb7a7dc540940e4731eac95539da51fb.png)

 ![Captura de pantalla de 2020-09-15 14-18-01](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/bd79bd90d34a9c40f4b128269d48e98c96ab350b.png)

---

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [September 17, 2020, 5:54am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/10 "2020-09-17T05:54:42Z")

</div>

Hi,

I am seeing another major change in the json structure. In anomaly we have:

community\_id  
metadata.flowbits  
anomaly events.

**cat eve.json | jq 'select(.anomaly)|.flow\_id,.anomaly’**

 ![Captura de pantalla de 2020-09-17 07-48-43](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/e8885368db7d155034d7e77b3485ce70e4424db8.png)

 ![Captura de pantalla de 2020-09-17 08-06-50](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/476e4678e74d03f5c1c8b19bcc6d89c16821da62.png)

On other occasions, it appears differently:

 ![Captura de pantalla de 2020-09-17 08-08-51](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/bd69647422bdfc6e741bd516bb4b6390f6fc008d.png)

Best Regads,

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [September 17, 2020, 7:04am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/11 "2020-09-17T07:04:01Z")

</div>

Thanks, I’ve opened [https://redmine.openinfosecfoundation.org/issues/3928](https://redmine.openinfosecfoundation.org/issues/3928)

---

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [September 17, 2020, 7:19am UTC](https://forum.suricata.io/t/suricata-6-0-0-rc1-json-structure/604/12 "2020-09-17T07:19:58Z")

</div>

hi,  
Okay. Thank you very much. We await the solution.