Filter fields in JSON export
Hi Team,
I am trying to read one pcap file, & convert it into Json file using tshark. After converting to Json file, It takes 250Mb per file. There are some fields like frame length, frame number, frame delta difference which are not required in json. Is there any way by which i can discard some of the fields related to frame information while converting to json. Please suggest.
Thanks & Regards, Neha Malhotra
There's no explicit way to exclude protocols or fields.
You would need to make a pass through the capture to get a protocol list, remove the not needed ones then run another pass with "-J" to only include those protocols. Or
grep
out what is not needed.Not sure what your receiver will do with the empty
frame
section:Thanks for providing your inputs. Tried using the above mentioned command, It seems it did not filter out the data.
Do we have any command by which we can remove frame related information. For example, I want to remove rows with field name =frame.encap_type & frame.offset_shift
(more)What is the command string used to produce the output above?
tshark -r file.pcap -T pdml > file.xml
Can't you use xml tools such as an xml transform (xslt) to post-process the xml? That's assuming the pdml output is well-formed.