Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add LogAscii::json_include_unset_fields flag to control unset field rendering

Browse source 
The flag controls whether JSON rendering includes unset &optional log fields
(F, the default), or includes them with a null value (T).
This commit is contained in:
Christian Kreibich 2021-12-06 17:49:25 -08:00
parent 7a6501296b
commit 1aaed1cc2e
9 changed files with 62 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/frameworks/logging/writers/ascii.zeek
View file

@ -66,6 +66,11 @@ export {
## This option is also available as a per-filter ``$config`` option.
const json_timestamps: JSON::TimestampFormat = JSON::TS_EPOCH &redef;
## Handling of optional fields when writing out JSON. By default the
## JSON formatter skips key and val when the field is absent. Setting
## the following field to T includes the key, with a null value.
const json_include_unset_fields = F &redef;
## If true, include lines with log meta information such as column names
## with types, the values of ASCII logging options that are in use, and
## the time when the file was opened and closed (the latter at the end).