Issue

When trying to upload gzip-compressed log files to a Panther HTTP source with a script parser, the compressed payload is not being properly decompressed before being passed to the parser, resulting in a JSON decoding error: failed to call 'parse' function: json.decode: at offset 0, unexpected character.

Resolution

To resolve this issue:

• When using curl to upload gzip-compressed files to Panther HTTP sources, use the --data-binary flag, instead of --data.

• Your curl command should follow this format:

curl --data-binary '@filename.gz' -H "Authorization: Bearer YOUR_TOKEN" YOUR_HTTP_SOURCE_URL

Cause

This issue occurs because the standard --data flag in curl may modify the binary content of the gzip-compressed file during transmission. The --data-binary flag ensures that the compressed data is sent exactly as-is, allowing Panther to properly detect and decompress the data before processing.

Panther supports ingesting gzip-compressed data for HTTP sources and automatically handles decompression without requiring additional headers. The compression algorithm is determined directly from the file content itself.