[Oisf-users] files-json.log

[Victor Julien]

On 01-05-19 18:56, F.Tremblay wrote:
> Hello,
> 
> Now that the files-json.log is gone, how can I tail only the "magic"
> from the eve.json
> 
> previously: tail -n200 -f /var/log/suricata/files-json.log | jq '.magic' 

tail -f /var/log/suricata/eve.json |jq -c
'select(.fileinfo.magic)|.fileinfo.magic'

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------