diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst index cf7f51b81d..9ee6d53d86 100644 --- a/doc/userguide/rules/datasets.rst +++ b/doc/userguide/rules/datasets.rst @@ -173,7 +173,7 @@ dataset with JSON Dataset with JSON allows matching data against a set and output data attached to the matching value in the event. -There is two format supported: ``json`` and ``ndjson``. The difference is that +There are two formats supported: ``json`` and ``ndjson``. The difference is that ``json`` format is a single JSON object, while ``ndjson`` is handling file with one JSON object per line. The ``ndjson`` format is useful for large files as the parsing is done line by line. @@ -196,7 +196,7 @@ data associated to the value (``bad_ones`` coming from ``enrichment_key`` option When format is ``json`` or ``ndjson``, the ``value_key`` is used to get the value in the line (``ndjson`` format) or in the array (``json`` format). -At least one single element needs to be have the ``value_key`` present in the data file to +At least one single element needs to have the ``value_key`` present in the data file to have a successful load. If ``array_key`` is present, Suricata will extract the corresponding subobject that has to be a JSON array and search for element to add to the set in this array. This is only valid for ``json`` format.