mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
c9aaf9e753
- It's not *exactly* ISO 8601 which doesn't seem to support subseconds, but subseconds are very important to us and most things that support ISO8601 seem to also support subseconds in the way I'm implemented it.
31 lines
550 B
Text
31 lines
550 B
Text
#
|
|
# @TEST-EXEC: bro -b %INPUT
|
|
# @TEST-EXEC: btest-diff ssh.log
|
|
#
|
|
# Testing all possible types.
|
|
|
|
redef LogAscii::use_json = T;
|
|
redef LogAscii::json_iso_timestamps = T;
|
|
|
|
module SSH;
|
|
|
|
export {
|
|
redef enum Log::ID += { LOG };
|
|
|
|
type Log: record {
|
|
t: time;
|
|
} &log;
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
Log::create_stream(SSH::LOG, [$columns=Log]);
|
|
Log::write(SSH::LOG, [
|
|
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "2008-07-09T16:13:30Z") + 0.00543210 secs)
|
|
]);
|
|
Log::write(SSH::LOG, [
|
|
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1986-12-01T01:01:01Z") + 0.90 secs)
|
|
]);
|
|
|
|
}
|
|
|