omerbenamram / evtx

Thanks for the effort to build this great tool, we're throwing it a forwarded log files and really appreciate the performance boost!

There's one minor step which required preprocessing for our use case, as we are loading data in Google's Bigquery.

I unfortunately don't have a build environment setup for rust atm, but it seems the responsible code is here, impacting both #attributes and #text:

evtx/src/json_output.rs

Line 239 in 0950198

value.insert("#attributes".to_owned(), Value::Object(attributes));

evtx/src/json_output.rs

Line 321 in 0950198

object.insert("#text".to_owned(), value.clone().into());

Is there a reason i'm missing to use a special character in these two field names? It's a rather minor issue and we can run sed, but it would save some steps.

Thanks in advance!

Hey @olamotte I highly recommend using the --separate-json-attributes. all element attributes are stored under the <FIELD_NAME>_attributes field name thus there are no #attributes and #text field names.

I had missed this - Thanks a lot!

# in JSON field name prevents import in GCP Bigquery