Documentation
¶
Index ¶
Constants ¶
View Source
const ( ReadSize = 64 * 1024 MaxLineSize = 50 * 1024 * 1024 )
Variables ¶
View Source
var ErrBadRecordDef = errors.New("bad types/fields definition in zeek header")
View Source
var ErrIncompatibleZeekType = errors.New("type cannot be represented in zeek format")
Functions ¶
func EscapeZeekHex ¶ added in v1.0.0
func FormatValue ¶ added in v1.0.0
func Unflatten ¶
Unflatten turns a set of fields from legacy Zeek logs into a Zed-compatible format by creating nested records for any dotted field names. If addpath is true, a _path field is added if not already present. The fields are returned as a slice along with a bool indicating if a _path field was added. Note that according to the Zed spec, all the fields for a nested record must be adjacent which simplifies the logic here.
Types ¶
type Parser ¶
type Parser struct {
// contains filtered or unexported fields
}
func (*Parser) Descriptor ¶
func (p *Parser) Descriptor() (*zed.TypeRecord, bool)
Descriptor returns the current descriptor (from the most recently seen #types and #fields lines) and a bool indicating whether _path was added to the descriptor. If no descriptor is present, nil and and false are returned.
func (*Parser) ParseDirective ¶
Source Files
Click to show internal directories.
Click to hide internal directories.