Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

factor out ascii input/output.

Browse source 
First step - factored out everything the logging classes
use ( so only output ).

Moved the script-level configuration to logging/main,
and made the individual writers just refer to it -
no idea if this is good design. It works. But I am happy
about opinions :)

Next step - add support for input...
This commit is contained in:
Bernhard Amann 2012-12-03 12:59:11 -08:00
parent f62df0de82
commit 501328d61a
13 changed files with 194 additions and 297 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/frameworks/logging/main.bro
View file

@ -17,6 +17,23 @@ export {
## anything else.
const default_writer = WRITER_ASCII &redef;
## Default separator between fields for logwriters.
## Can be overwritten by individual writers.
const separator = "\t" &redef;
## Separator between set elements.
## Can be overwritten by individual writers.
const set_separator = "," &redef;
## String to use for empty fields. This should be different from
## *unset_field* to make the output non-ambigious.
## Can be overwritten by individual writers.
const empty_field = "(empty)" &redef;
## String to use for an unset &optional field.
## Can be overwritten by individual writers.
const unset_field = "-" &redef;
## Type defining the content of a logging stream.
type Stream: record {
## A record type defining the log's columns.

8
scripts/base/frameworks/logging/writers/ascii.bro
View file

@ -25,17 +25,17 @@ export {
const meta_prefix = "#" &redef;
## Separator between fields.
const separator = "\t" &redef;
const separator = Log::separator &redef;
## Separator between set elements.
const set_separator = "," &redef;
const set_separator = Log::set_separator &redef;
## String to use for empty fields. This should be different from
## *unset_field* to make the output non-ambigious.
const empty_field = "(empty)" &redef;
const empty_field = Log::empty_field &redef;
## String to use for an unset &optional field.
const unset_field = "-" &redef;
const unset_field = Log::unset_field &redef;
}
# Default function to postprocess a rotated ASCII log file. It moves the rotated