#3201·arkime

Payload UTF8 and Hex fields are incorrectly set up

Author: mcgillowenCreated May 7, 2025Updated Jul 6, 2026
Labelsbug

Describe the bug This is a followup to the issue #2787.

In the field dropdown list for columns or info column, only Payload Src/Dst Hex is visible but when selected it displays Payload Src/Dst UTF8 but with the hex value instead of the UTF8 value.

In db.pl the UTF8 payload fields have a transform utf8ToHex, but it should be the inverse.

Image

Elasticsearch version: 8.15.2

Arkime/Moloch version: 5.6.3

OS name and version: Ubuntu 22.04

How was Arkime/Moloch built/installed: (rpm, deb, easybutton, ...)

easybutton

Provide logs, stack traces and steps to reproduce:

  1. Searching for fields we can show in that column, "Payload" only gives the option to put the "HEX" version of the field.
  2. But when selected, the field's label shown in "Info" column is the "UTF8" version of the field, while the value is still the HEX.
  3. When clicking the value to add it as search parameter, it adds the field's UTF8 name combined with the HEX value.