0

When extracting json from wireshark. I get multiple 'asterix' entries in the json data. However when loading into python only the second asterix packet is loaded. Example json data below with ... replacing excess lines.

[
  {
    "_index": "packets-2021-07-02",
    "_type": "doc",
    "_score": null,
    "_source": {
      "layers": {
        "frame": { ...
        },
        "eth": {  ...      
        },
        "ip": { ...
        },
        "udp": { ...
        },
        "asterix": {
          "asterix.category": "48",
          "asterix.length": "54",
          "asterix.message": { ...
          }
        },
        "asterix": {
          "asterix.category": "34",
          "asterix.length": "20",
          "asterix.message": { ...
          }    
        }
     }
  }
]

using the code below to import into python

import json
data=json.load(open(r'C:\Users\cjtlo\Documents\json_2packet.json'))
print(data)

This results in data without the category 48 asterix in the print of data.

[
  {
    "_index": "packets-2021-07-02",
    "_type": "doc",
    "_score": null,
    "_source": {
      "layers": {
        "frame": { ...
        },
        "eth": {  ...      
        },
        "ip": { ...
        },
        "udp": { ...
        },
        "asterix": {
          "asterix.category": "34",
          "asterix.length": "20",
          "asterix.message": { ...
          }    
       }
     }
  }
]

If I manually remove the category 34 data then the category 48 exists. Is this to do with them both having the same name 'asterix'? Any help much appreciated.

clong
  • 1

0 Answers0