Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

make filters pointers (for inheritance)

Browse source
This commit is contained in:
Bernhard Amann 2011-11-22 11:39:27 -08:00
parent f82bf3f35f
commit 3c40f00a53
7 changed files with 507 additions and 160 deletions
Download patch file Download diff file Expand all files Collapse all files

16
testing/btest/scripts/base/frameworks/input/event.bro
View file

@ -16,7 +16,6 @@
7 T
@TEST-END-FILE
redef InputAscii::empty_field = "EMPTY";
module A;
@ -24,25 +23,20 @@ export {
redef enum Log::ID += { LOG };
}
type Idx: record {
i: int;
};
type Val: record {
i: int;
b: bool;
};
global destination: table[int] of Val = table();
event line(tpe: Input::Event, left: Idx, right: bool) {
event line(tpe: Input::Event, i: int, b: bool) {
print tpe;
print left;
print right;
print i;
print b;
}
event bro_init()
{
Input::create_stream(A::LOG, [$source="input.log"]);
Input::add_tablefilter(A::LOG, [$name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F,$ev=line]);
Input::add_eventfilter(A::LOG, [$name="input", $fields=Val, $ev=line]);
Input::force_update(A::LOG);
}

48
testing/btest/scripts/base/frameworks/input/tableevent.bro Normal file
View file

@ -0,0 +1,48 @@
#
# @TEST-EXEC: bro %INPUT >out
# @TEST-EXEC: btest-diff out
@TEST-START-FILE input.log
#separator \x09
#path ssh
#fields i b
#types int bool
1 T
2 T
3 F
4 F
5 F
6 F
7 T
@TEST-END-FILE
redef InputAscii::empty_field = "EMPTY";
module A;
export {
redef enum Log::ID += { LOG };
}
type Idx: record {
i: int;
};
type Val: record {
b: bool;
};
global destination: table[int] of Val = table();
event line(tpe: Input::Event, left: Idx, right: bool) {
print tpe;
print left;
print right;
}
event bro_init()
{
Input::create_stream(A::LOG, [$source="input.log"]);
Input::add_tablefilter(A::LOG, [$name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F,$ev=line]);
Input::force_update(A::LOG);
}