Skip to main content
Panther Knowledge Base

Classification Error 'readEscapedChar' when parsing logs in Panther

  1. Last updated
  2. Save as PDF

Issue

When trying to parse or infer an event log the following error occurs: 

"error": "invalid stream: readEscapedChar: invalid escape char after \\

Resolution

To resolve this issue:

  1. Identify the field in the event log that has the '\\' escape characters in its value.
  2. Modify how the source sends that field value in order for the value to be parsed.
    • For example, fastly has a json.escape method to handle this type of value.

Cause

This issue occurs when a field's value contains the '\\' escape characters in its value which causes the rest of the log to be out of format. This causes every field beyond that problem field to not parse entirely.