mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 08:38:20 +00:00
GH-606: Output nulls into json data if a field isn't set
This commit is contained in:
parent
95489d52d8
commit
d4c394b72a
6 changed files with 21 additions and 2 deletions
|
@ -458,6 +458,10 @@ TableVal* Val::GetRecordFields()
|
||||||
// This is a static method in this file to avoid including json.hpp in Val.h since it's huge.
|
// This is a static method in this file to avoid including json.hpp in Val.h since it's huge.
|
||||||
static ZeekJson BuildJSON(Val* val, bool only_loggable=false, RE_Matcher* re=new RE_Matcher("^_"))
|
static ZeekJson BuildJSON(Val* val, bool only_loggable=false, RE_Matcher* re=new RE_Matcher("^_"))
|
||||||
{
|
{
|
||||||
|
// If the value wasn't set, return a nullptr. This will get turned into a 'null' in the json output.
|
||||||
|
if ( ! val )
|
||||||
|
return nullptr;
|
||||||
|
|
||||||
ZeekJson j;
|
ZeekJson j;
|
||||||
BroType* type = val->Type();
|
BroType* type = val->Type();
|
||||||
switch ( type->Tag() )
|
switch ( type->Tag() )
|
||||||
|
@ -2869,7 +2873,7 @@ int VectorVal::AddTo(Val* val, int /* is_first_init */) const
|
||||||
Val* VectorVal::Lookup(unsigned int index) const
|
Val* VectorVal::Lookup(unsigned int index) const
|
||||||
{
|
{
|
||||||
if ( index >= val.vector_val->size() )
|
if ( index >= val.vector_val->size() )
|
||||||
return 0;
|
return nullptr;
|
||||||
|
|
||||||
return (*val.vector_val)[index];
|
return (*val.vector_val)[index];
|
||||||
}
|
}
|
||||||
|
|
|
@ -73,6 +73,10 @@ threading::Value* JSON::ParseValue(const string& s, const string& name, TypeTag
|
||||||
|
|
||||||
ZeekJson JSON::BuildJSON(Value* val, const string& name) const
|
ZeekJson JSON::BuildJSON(Value* val, const string& name) const
|
||||||
{
|
{
|
||||||
|
// If the value wasn't set, return a nullptr. This will get turned into a 'null' in the json output.
|
||||||
|
if ( ! val->present )
|
||||||
|
return nullptr;
|
||||||
|
|
||||||
ZeekJson j;
|
ZeekJson j;
|
||||||
switch ( val->type )
|
switch ( val->type )
|
||||||
{
|
{
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
{"b":true,"i":-42,"e":"SSH::LOG","c":21,"p":123,"sn":"10.0.0.0/24","a":"1.2.3.4","d":3.14,"t":1215620010.54321,"iv":100.0,"s":"hurz","sc":[2,4,1,3],"ss":["BB","AA","CC"],"se":[],"vc":[10,20,30],"ve":[],"f":"SSH::foo\n{ \nif (0 < SSH::i) \n\treturn (Foo);\nelse\n\treturn (Bar);\n\n}"}
|
{"b":true,"i":-42,"e":"SSH::LOG","c":21,"p":123,"sn":"10.0.0.0/24","a":"1.2.3.4","d":3.14,"t":1215620010.54321,"iv":100.0,"s":"hurz","sc":[2,4,1,3],"ss":["BB","AA","CC"],"se":[],"vc":[10,20,30],"ve":[],"vn":[0,null,2],"f":"SSH::foo\n{ \nif (0 < SSH::i) \n\treturn (Foo);\nelse\n\treturn (Bar);\n\n}"}
|
||||||
|
|
|
@ -28,6 +28,7 @@ true
|
||||||
["1.2.3.4"]
|
["1.2.3.4"]
|
||||||
[[true,false]]
|
[[true,false]]
|
||||||
[{"s":"test"}]
|
[{"s":"test"}]
|
||||||
|
[0,null,2]
|
||||||
[]
|
[]
|
||||||
[2,1]
|
[2,1]
|
||||||
["1.2.3.4"]
|
["1.2.3.4"]
|
||||||
|
|
|
@ -28,6 +28,7 @@ export {
|
||||||
se: set[string];
|
se: set[string];
|
||||||
vc: vector of count;
|
vc: vector of count;
|
||||||
ve: vector of string;
|
ve: vector of string;
|
||||||
|
vn: vector of count;
|
||||||
f: function(i: count) : string;
|
f: function(i: count) : string;
|
||||||
} &log;
|
} &log;
|
||||||
}
|
}
|
||||||
|
@ -47,6 +48,10 @@ event zeek_init()
|
||||||
local empty_set: set[string];
|
local empty_set: set[string];
|
||||||
local empty_vector: vector of string;
|
local empty_vector: vector of string;
|
||||||
|
|
||||||
|
local vector_with_null: vector of count;
|
||||||
|
vector_with_null[0] = 0;
|
||||||
|
vector_with_null[2] = 2;
|
||||||
|
|
||||||
Log::write(SSH::LOG, [
|
Log::write(SSH::LOG, [
|
||||||
$b=T,
|
$b=T,
|
||||||
$i=-42,
|
$i=-42,
|
||||||
|
@ -64,6 +69,7 @@ event zeek_init()
|
||||||
$se=empty_set,
|
$se=empty_set,
|
||||||
$vc=vector(10, 20, 30),
|
$vc=vector(10, 20, 30),
|
||||||
$ve=empty_vector,
|
$ve=empty_vector,
|
||||||
|
$vn=vector_with_null,
|
||||||
$f=foo
|
$f=foo
|
||||||
]);
|
]);
|
||||||
}
|
}
|
||||||
|
|
|
@ -93,11 +93,15 @@ event zeek_init()
|
||||||
local ve3: vector of addr = vector(1.2.3.4);
|
local ve3: vector of addr = vector(1.2.3.4);
|
||||||
local ve4: vector of set[bool] = vector(set(T, F));
|
local ve4: vector of set[bool] = vector(set(T, F));
|
||||||
local ve5: vector of myrec1 = vector(myrec1($s="test", $c=2));
|
local ve5: vector of myrec1 = vector(myrec1($s="test", $c=2));
|
||||||
|
local ve6: vector of count;
|
||||||
|
ve6[0] = 0;
|
||||||
|
ve6[2] = 2;
|
||||||
print to_json(ve1);
|
print to_json(ve1);
|
||||||
print to_json(ve2);
|
print to_json(ve2);
|
||||||
print to_json(ve3);
|
print to_json(ve3);
|
||||||
print to_json(ve4);
|
print to_json(ve4);
|
||||||
print to_json(ve5, T);
|
print to_json(ve5, T);
|
||||||
|
print to_json(ve6);
|
||||||
|
|
||||||
# Sets
|
# Sets
|
||||||
local st1: set[count] = set();
|
local st1: set[count] = set();
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue