Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add LogAscii::json_include_unset_fields flag to control unset field rendering

Browse source 
The flag controls whether JSON rendering includes unset &optional log fields
(F, the default), or includes them with a null value (T).
This commit is contained in:
Christian Kreibich 2021-12-06 17:49:25 -08:00
parent 7a6501296b
commit 1aaed1cc2e
9 changed files with 62 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

28
testing/btest/scripts/base/frameworks/logging/ascii-json-optional.zeek
View file

@ -1,10 +1,20 @@
# This test verifies the behavior of the JSON writer regarding unset optional
# values. By default, such fields are skipped, while redef'ing
# LogAscii::json_include_unset_fields=T or using a filter's config table to set a
# field of the same name includes them with a null value.
#
# @TEST-EXEC: zeek -b %INPUT
# @TEST-EXEC: btest-diff testing.log
#
# @TEST-EXEC: zeek -b %INPUT LogAscii::json_include_unset_fields=T Testing::logname=testing_nullfields
# @TEST-EXEC: btest-diff testing_nullfields.log
#
# @TEST-EXEC: zeek -b %INPUT Testing::use_config_table=T Testing::logname=testing_nullfields_via_config
# @TEST-EXEC: btest-diff testing_nullfields_via_config.log
@load tuning/json-logs
module testing;
module Testing;
export {
redef enum Log::ID += { LOG };
@ -15,13 +25,23 @@ export {
};
global log_test: event(rec: Info);
const logname = "testing" &redef;
const use_config_table = F &redef;
}
event zeek_init() &priority=5
{
Log::create_stream(testing::LOG, [$columns=testing::Info, $ev=log_test]);
Log::create_stream(LOG, [$columns=Info, $ev=log_test, $path=logname]);
if ( use_config_table )
{
local f = Log::get_filter(LOG, "default");
f$config = table(["json_include_unset_fields"] = "T");
Log::add_filter(LOG, f);
}
local info: Info;
info$msg = "Testing 1 2 3 ";
Log::write(testing::LOG, info);
Log::write(LOG, info);
}