Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

NEWS: Add note about generic event metadata

Browse source
This commit is contained in:
Arne Welzel 2025-05-26 17:50:25 +02:00
parent 8e87dcbdb2
commit 7db03a8c77
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
NEWS
View file

@ -25,9 +25,9 @@ Breaking Changes
metadata to justify the complexity of treating it separate. metadata to justify the complexity of treating it separate.
- The ``current_event_time()`` builtin function as well as ``Event::Time()`` - The ``current_event_time()`` builtin function as well as ``Event::Time()``
and ``EventMgr::CurrentEventTime()`` now return ``-1.0`` if not timestamp and ``EventMgr::CurrentEventTime()`` now return ``-1.0`` if no timestamp
metadata is available for the current event, or if no event is being metadata is available for the current event, or if no event is being
dispatched. Previously this would've likely been 0.0, or the previously dispatched. Previously this would've been 0.0, or the timestamp of the previously
dispatched event. dispatched event.
- Missing network timestamp metadata on remote events is not set to the local - Missing network timestamp metadata on remote events is not set to the local
@ -40,6 +40,10 @@ Breaking Changes
New Functionality New Functionality
----------------- -----------------
- Generic event metadata support. A new ``EventMetadata`` module was added allowing
to register generic event metadata types and accessing the current event's metadata
using the functions ``current()`` and ``current_all()`` of this module.
- A new plugin hook, ``HookPublishEvent()``, has been added for intercepting - A new plugin hook, ``HookPublishEvent()``, has been added for intercepting
publishing of Zeek events. This hook may be used for monitoring purposes, publishing of Zeek events. This hook may be used for monitoring purposes,
modifying or rerouting remote events. modifying or rerouting remote events.