Payload UTF8 and Hex fields are incorrectly set up
Author: mcgillowenCreated May 7, 2025Updated Jul 6, 2026
Labelsbug
Describe the bug This is a followup to the issue #2787.
In the field dropdown list for columns or info column, only Payload Src/Dst Hex is visible but when selected it displays Payload Src/Dst UTF8 but with the hex value instead of the UTF8 value.
In db.pl the UTF8 payload fields have a transform utf8ToHex, but it should be the inverse.
Elasticsearch version: 8.15.2
Arkime/Moloch version: 5.6.3
OS name and version: Ubuntu 22.04
How was Arkime/Moloch built/installed: (rpm, deb, easybutton, ...)
easybutton
Provide logs, stack traces and steps to reproduce:
- Searching for fields we can show in that column, "Payload" only gives the option to put the "HEX" version of the field.
- But when selected, the field's label shown in "Info" column is the "UTF8" version of the field, while the value is still the HEX.
- When clicking the value to add it as search parameter, it adds the field's UTF8 name combined with the HEX value.
Source: arkime/arkime