--- title: Looking at suricata JSON events on command line description: Looking at suricata JSON events on command line image: https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220437.png --- [![Stamus-Logo-with-R-color-small](https://www.stamus-networks.com/hubfs/Stamus-Logo-with-R-color-small.png "Stamus-Logo-with-R-color-small")](https://www.stamus-networks.com/?hsLang=en) # Looking at suricata JSON events on command line by [Eric Leblond](https://www.stamus-networks.com/blog/author/eric-leblond) | May 18, 2015 | [Suricata](https://www.stamus-networks.com/blog/tag/suricata) ![](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220437.png) [Suricata](https://www.stamus-networks.com/simplifying-suricata?hsLang=en) EVE JSON format is becoming the de-facto standard for this IDS. All type of events are now exported to this format. The JSON format allows a nice handling of data in external tool like Elasticsearch or even [DOM](https://github.com/regit/DOM). The output is readable by human but as an event/record can contain a lot of data it can be difficult to do a by-eye analysis when looking at a file. The following screenshot give you an idea of the possible output: [![Tailing EVE](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220957.png?width=941&height=296&name=Screenshot-from-2015-05-18-220957.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220957.png?hsLang=en) Using standard unix tools like grep on the EVE JSON file is not the perfect idea. For example if you want to extract a field to get some statistics you may want to try using grep, cut or awk but you may find it painful. And it is worthed to mention here that JSON fields are not ordered. Here to the rescue comes the [jq](http://stedolan.github.io/jq/) utility. jq is a tool dedicated to the transformation/parsing of a JSON entry. It is Debian packaged, so a simple `apt-get install jq` is enough for the install. [![Some jq examples](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220033.png?width=838&height=267&name=Screenshot-from-2015-05-18-220033.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220033.png?hsLang=en) The most basic usage is to colorize the entry. To do that, just do something like ``` $ tail -n100 eve.json| jq '.' ``` The output is done the pretty way: [![JQ displaying an event](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220437.png?width=423&height=336&name=Screenshot-from-2015-05-18-220437.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-220437.png?hsLang=en) To get a one line per event output, just add the `-c` flag to the command: [![One line](https://www.stamus-networks.com/hs-fs/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-221126.png?width=941&height=84&name=Screenshot-from-2015-05-18-221126.png)](https://www.stamus-networks.com/hubfs/Imported_Blog_Media/Screenshot-from-2015-05-18-221126.png?hsLang=en) To extract a single field from the JSON events, one can do: ``` $ jq '.src_ip' eve.json "58.218.211.155" "58.218.211.155" "58.218.211.155" ``` The point to remember is that the point in `.src_ip` is a place holder for the current entry. By default when a field is not present `null` is displayed in the output. To fix that, it is possible to filter the event to only get the one we are interested in. This is done via the `select` keyword. For instance to select the SSH events and extract the information about the client part one can do: ``` $ tail eve.json | jq -c 'select(.event_type == "ssh")|.ssh.client' {"proto_version":"2.0","software_version":"PUTTY"} {"proto_version":"2.0","software_version":"PUTTY"} ``` Far more things can be done with jq. Good starting points are the [jq manual](http://stedolan.github.io/jq/manual/) and [wiki](https://github.com/stedolan/jq/wiki). [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/share.php?u=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2015%2F05%2F18%2Flooking-at-suricata-json-events-on-command-line%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2015%2F05%2F18%2Flooking-at-suricata-json-events-on-command-line%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2015%2F05%2F18%2Flooking-at-suricata-json-events-on-command-line%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2015%2F05%2F18%2Flooking-at-suricata-json-events-on-command-line%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2015%2F05%2F18%2Flooking-at-suricata-json-events-on-command-line%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2F2015%2F05%2F18%2Flooking-at-suricata-json-events-on-command-line%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Eric Leblond](https://www.stamus-networks.com/hubfs/Stamus_Eric_Square-1.jpg) #### Eric Leblond Éric Leblond is the co-founder and chief technology officer (CTO) at Stamus Networks. He sits on the board of directors at Open Network Security Foundation (OISF). Éric has more than 15 years of experience as co-founder and technologist of cybersecurity software companies and is an active member of the security and open-source communities. He has worked on the development of Suricata – the open-source network threat detection engine – since 2009 and is part of the Netfilter Core team, responsible for the Linux kernel's firewall layer. Eric is a respected expert and speaker on all things network security. Éric resides in Escalles, France. [**](https://www.linkedin.com/in/ericleblond) [** ](https://twitter.com/Regiteric) ## Schedule a Demo of Clear NDR [![REQUEST A DEMO](https://no-cache.hubspot.com/cta/default/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f.png)](https://cta-redirect.hubspot.com/cta/redirect/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f) ## Related posts [![Suricata Language Server 2.0 Now Available from Stamus Networks](https://www.stamus-networks.com/hubfs/SN-SLS-2-Blog-Featured.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-2.0?hsLang=en) ### [Suricata Language Server 2.0: Major Update with Workspace Intelligence](https://www.stamus-networks.com/blog/suricata-language-server-2.0?hsLang=en) We're excited to announce version 2.0 of the Suricata Language Server, featuring workspace-wide... [![Suricata Language Server 1.3.0: Automated PCAP Testing, Multi-Version Support, and Syntax Highlighting](https://www.stamus-networks.com/hubfs/SLS-1.3-18-Dec-2025.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support?hsLang=en) ### [Suricata Language Server 1.3.0: Automated PCAP Testing, Multi-Version Support, and Syntax Highlighting](https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support?hsLang=en) [Suricata Language Server](https://www.stamus-networks.com/suricata-language-server?hsLang=en) 1.3.0 is now available and it surfs on the concept of magic comment... [![](https://www.stamus-networks.com/hubfs/SLS-1.1.0-13-Nov-2025.jpg) ](https://www.stamus-networks.com/blog/suricata-language-server-1.1.0-reduces-installation-requirements-with-docker-container-mode?hsLang=en) ### [Suricata Language Server 1.1.0 Reduces Installation Requirements with Docker Container Mode](https://www.stamus-networks.com/blog/suricata-language-server-1.1.0-reduces-installation-requirements-with-docker-container-mode?hsLang=en) Writing and validating Suricata signatures shouldn't require wrestling with complex installation... [![Stamus-Logo-with-R-white](https://www.stamus-networks.com/hs-fs/hubfs/Stamus-Logo-with-R-white.png?width=2000&height=536&name=Stamus-Logo-with-R-white.png "Stamus-Logo-with-R-white")](https://www.stamus-networks.com/?hsLang=en) ABOUT STAMUS® NETWORKS Stamus Networks is the network intelligence foundation for AI-powered security operations and the creator of the Clear NDR® system. Built on Suricata, the world's leading open-source network security engine, Clear NDR transforms raw network traffic into actionable security insights with unmatched transparency, customization, and effectiveness. Designed to close visibility gaps and reduce alert fatigue, Clear NDR is trusted by leading financial institutions, government agencies, and has been battle-tested over ten years in NATO's largest cybersecurity exercises. Stamus Networks empowers security teams with greater control, fewer false positives, faster response times, and a more responsive, open approach than legacy vendors. - [**](https://www.linkedin.com/company/stamus-networks) - [**](https://twitter.com/StamusN/) - [**](https://www.youtube.com/Stamus-Networks) - [* *](https://discord.gg/JUMSU9uA) - Paris, FranceIndianapolis, USA **[contact@stamus-networks.com](mailto:contact@stamus-networks.com) [Privacy](https://www.stamus-networks.com/privacy-policy?hsLang=en) © 2014-2026 Stamus Networks, Inc. All rights Reserved.