From 20a0575d96e936ed5d297e78d17d5c92a8faecc0 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Fri, 6 Jun 2025 13:35:00 +0200 Subject: [PATCH] doc/userguide: fix some typos Suggestions from Juliana. Co-authored-by: Juliana Fajardini Reichow --- doc/userguide/rules/datasets.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst index cf7f51b81d..9ee6d53d86 100644 --- a/doc/userguide/rules/datasets.rst +++ b/doc/userguide/rules/datasets.rst @@ -173,7 +173,7 @@ dataset with JSON Dataset with JSON allows matching data against a set and output data attached to the matching value in the event. -There is two format supported: ``json`` and ``ndjson``. The difference is that +There are two formats supported: ``json`` and ``ndjson``. The difference is that ``json`` format is a single JSON object, while ``ndjson`` is handling file with one JSON object per line. The ``ndjson`` format is useful for large files as the parsing is done line by line. @@ -196,7 +196,7 @@ data associated to the value (``bad_ones`` coming from ``enrichment_key`` option When format is ``json`` or ``ndjson``, the ``value_key`` is used to get the value in the line (``ndjson`` format) or in the array (``json`` format). -At least one single element needs to be have the ``value_key`` present in the data file to +At least one single element needs to have the ``value_key`` present in the data file to have a successful load. If ``array_key`` is present, Suricata will extract the corresponding subobject that has to be a JSON array and search for element to add to the set in this array. This is only valid for ``json`` format. -- 2.47.2