mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
7ff2a3e115
This required adding the ability for RecordVal::CoerceTo functions to optionally allow orphaning fields. The default is to not allow it, but now before writing to a log, the value of the stream's columns is coerced down, if necessary, before passing it on to the filter's path_func. Addresses #600.
26 lines
814 B
Text
26 lines
814 B
Text
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
|
# @TEST-EXEC: btest-diff local.log
|
|
# @TEST-EXEC: btest-diff remote.log
|
|
#
|
|
# The record value passed into the path_func should be allowed to contain a
|
|
# subset of the fields in the stream's columns.
|
|
|
|
@load base/utils/site
|
|
@load base/protocols/conn
|
|
@load base/frameworks/notice
|
|
|
|
redef Site::local_nets = {141.142.0.0/16};
|
|
|
|
function split_log(id: Log::ID, path: string, rec: record {id:conn_id;}): string
|
|
{
|
|
return Site::is_local_addr(rec$id$orig_h) ? "local" : "remote";
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
# Add a new filter to the Conn::LOG stream that logs only
|
|
# timestamp and originator address.
|
|
local filter: Log::Filter = [$name="dst-only", $path_func=split_log,
|
|
$include=set("ts", "id.orig_h")];
|
|
Log::add_filter(Conn::LOG, filter);
|
|
}
|