zeek/testing
Arne Welzel 93813a5079 logging/ascii/json: Make TS_MILLIS signed, add TS_MILLIS_UNSIGNED
It seems TS_MILLIS is specifically for Elasticsearch and starting with
Elasticsearch 8.2 epoch_millis does (again?) support negative epoch_millis,
so make Zeek produce that by default.

If this breaks a given deployment, they can switch Zeek back to TS_MILLIS_UNSIGNED.

https://discuss.elastic.co/t/migration-from-es-6-8-to-7-17-issues-with-negative-date-epoch-timestamp/335259
https://github.com/elastic/elasticsearch/pull/80208

Thanks for @timo-mue for reporting!

Closes #4494
2025-05-30 17:23:29 +02:00
..
benchmark/broker
btest logging/ascii/json: Make TS_MILLIS signed, add TS_MILLIS_UNSIGNED 2025-05-30 17:23:29 +02:00
builtin-plugins CI: Add external plugins to builtin plugins task 2025-03-31 14:19:18 +02:00
coverage Swap pre-commit yapf for ruff/ruff-format, fix findings 2024-12-11 11:08:37 -07:00
external Merge remote-tracking branch 'origin/topic/etyp/redis-analyzer' 2025-05-27 10:20:00 -04:00
scripts cluster/websocket: Deprecate $listen_host, introduce $listen_addr 2025-05-30 11:02:41 +02:00
.gitignore
CMakeLists.txt
Makefile
README

This directory contains suites for testing for Zeek's correct
operation:

    btest/
        An ever-growing set of small unit tests testing Zeek's
        functionality.

    external/
        A framework for downloading additional test sets that run more
        complex Zeek configuration on larger traces files. Due to their
        size, these are not included directly. See the README for more
        information. 

    scripts/
        Helpers scripts used by some tests.