Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add LogAscii::json_include_unset_fields flag to control unset field rendering

Browse source 
The flag controls whether JSON rendering includes unset &optional log fields
(F, the default), or includes them with a null value (T).
This commit is contained in:
Christian Kreibich 2021-12-06 17:49:25 -08:00
parent 7a6501296b
commit 1aaed1cc2e
9 changed files with 62 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/logging/writers/ascii/Ascii.cc
View file

@ -197,6 +197,7 @@ Ascii::Ascii(WriterFrontend* frontend) : WriterBackend(frontend)
tsv = false;
use_json = false;
enable_utf_8 = false;
json_include_unset_fields = false;
formatter = nullptr;
gzip_level = 0;
gzfile = nullptr;
@ -232,6 +233,8 @@ void Ascii::InitConfigOptions()
BifConst::LogAscii::json_timestamps->Describe(&tsfmt);
json_timestamps.assign((const char*)tsfmt.Bytes(), tsfmt.Len());
json_include_unset_fields = BifConst::LogAscii::json_include_unset_fields;
gzip_file_extension.assign((const char*)BifConst::LogAscii::gzip_file_extension->Bytes(),
BifConst::LogAscii::gzip_file_extension->Len());
@ -329,6 +332,20 @@ bool Ascii::InitFilterOptions()
else if ( strcmp(i->first, "json_timestamps") == 0 )
json_timestamps.assign(i->second);
else if ( strcmp(i->first, "json_include_unset_fields") == 0 )
{
if ( strcmp(i->second, "T") == 0 )
json_include_unset_fields = true;
else if ( strcmp(i->second, "F") == 0 )
json_include_unset_fields = false;
else
{
Error("invalid value for 'json_include_unset_fields', must be "
"a string and either \"T\" or \"F\"");
return false;
}
}
else if ( strcmp(i->first, "gzip_file_extension") == 0 )
gzip_file_extension.assign(i->second);
@ -364,7 +381,7 @@ bool Ascii::InitFormatter()
return false;
}
formatter = new threading::formatter::JSON(this, tf);
formatter = new threading::formatter::JSON(this, tf, json_include_unset_fields);
// Using JSON implicitly turns off the header meta fields.
include_meta = false;
}

1
src/logging/writers/ascii/Ascii.h
View file

@ -78,6 +78,7 @@ private:
bool use_json;
bool enable_utf_8;
std::string json_timestamps;
bool json_include_unset_fields;
std::string logdir;
threading::Formatter* formatter;

1
src/logging/writers/ascii/ascii.bif
View file

@ -14,6 +14,7 @@ const use_json: bool;
const enable_leftover_log_rotation: bool;
const enable_utf_8: bool;
const json_timestamps: JSON::TimestampFormat;
const json_include_unset_fields: bool;
const gzip_level: count;
const gzip_file_extension: string;
const logdir: string;