From: Eric Leblond Date: Sun, 6 Apr 2025 08:35:59 +0000 (+0200) Subject: doc/userguide: remove left over datajson reference X-Git-Tag: suricata-8.0.0-rc1~60 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a652eee508f6074e56847fa445493834f370eea0;p=thirdparty%2Fsuricata.git doc/userguide: remove left over datajson reference --- diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst index b35f60ddd3..e398b73668 100644 --- a/doc/userguide/rules/datasets.rst +++ b/doc/userguide/rules/datasets.rst @@ -170,7 +170,7 @@ value is higher than 200. dataset with json ~~~~~~~~~~~~~~~~~ -DataJSON allows matching data against a set and output data attached to the matching +Dataset with JSON allows matching data against a set and output data attached to the matching value in the event. There is two format supported: ``json`` and ``jsonline``. The difference is that @@ -204,7 +204,7 @@ a JSON array and search for element to add to the set in this array. This is onl If you don't want to have the ``value_key`` in the alert, you can use the ``remove_key`` option. This will remove the key from the alert event. -See :ref:`Datajson format ` for more information. +See :ref:`Dataset with JSON format ` for more information. Rule Reloads ------------ @@ -398,7 +398,7 @@ For example, if the file ``file.json`` is like the following example (typical of } } -then the match to check the list of threats using datajson can be defined as :: +then the match to check the list of threats using dataset with JSON can be defined as :: http.host; dataset:isset,threats,load file.json, enrichment_key threat, value_key host, array_key response.threats;