mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
985bbe4e57
Add new syntax for adding and removing attributes from record fields:
redef RecordType$field_name += { &log };
redef RecordType$field_name -= { &log };
For now this only allowed for the &log attribute as the semantics are clear.
For &default and &optional the semantics aren't obvious and no use-cases have
been identified where those would make sense to change.
This enables a mechanism to add potentially interesting fields to the typical
Info records in base scripts, but letting users opt-into actually including
them into their log. At the same time, users that find specific fields in a
standard log uninteresting can opt-out without using `Log::Filter$exclude`
which can be difficult to use correctly. Patching or forking external packages
to remove columns from a log can also be avoided with this mechanism.
Closes #2000.
56 lines
1.5 KiB
Text
56 lines
1.5 KiB
Text
# @TEST-DOC: Redef'ing of record fields for adding and removing &log from them.
|
|
# @TEST-EXEC: zeek -b %INPUT >output
|
|
# @TEST-EXEC: btest-diff output
|
|
# @TEST-EXEC: btest-diff test.log
|
|
|
|
module RedefRecordTest;
|
|
|
|
export {
|
|
redef enum Log::ID += { LOG };
|
|
|
|
type Info: record {
|
|
ts: time &log;
|
|
msg: string &log;
|
|
extra1: string &log &optional;
|
|
extra2: string &optional;
|
|
extra3: string &optional;
|
|
extra4: string &optional;
|
|
};
|
|
}
|
|
|
|
# Adding an extra &log is fine: Making something &log by default
|
|
# shouldn't break users.
|
|
redef record Info$msg += { &log };
|
|
|
|
# Don't log extra1
|
|
redef record Info$extra1 -= { &log };
|
|
|
|
# Don't log extra2 (default, but remove &log) again
|
|
redef record Info$extra2 -= { &log };
|
|
|
|
# Do log extra3
|
|
redef record Info$extra3 += { &log };
|
|
|
|
# Redef extra4 from global scope (remove and re-add &log)
|
|
module GLOBAL;
|
|
redef record RedefRecordTest::Info$extra4 -= { &log };
|
|
redef record RedefRecordTest::Info$extra4 += { &log };
|
|
|
|
module RedefRecordTest;
|
|
|
|
# zeek_init() for testing of print and logging.
|
|
event zeek_init()
|
|
{
|
|
print "Info record_fields\n", record_fields(Info);
|
|
local rec = Info(
|
|
$ts=double_to_time(1660142487.54),
|
|
$msg="msg",
|
|
$extra1="extra1 value",
|
|
$extra2="extra2 value",
|
|
$extra3="extra3 value",
|
|
$extra4="extra4 value"
|
|
);
|
|
print "Info record", rec;
|
|
Log::create_stream(LOG, [$columns=Info, $path="test"]);
|
|
Log::write(LOG, rec);
|
|
}
|