mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
101 lines
4 KiB
Text
101 lines
4 KiB
Text
##! Interface for the ASCII log writer. Redefinable options are available
|
|
##! to tweak the output format of ASCII logs.
|
|
##!
|
|
##! The ASCII writer currently supports one writer-specific per-filter config
|
|
##! option: setting ``tsv`` to the string ``T`` turns the output into
|
|
##! "tab-separated-value" mode where only a single header row with the column
|
|
##! names is printed out as meta information, with no "# fields" prepended; no
|
|
##! other meta data gets included in that mode. Example filter using this::
|
|
##!
|
|
##! local f: Log::Filter = [$name = "my-filter",
|
|
##! $writer = Log::WRITER_ASCII,
|
|
##! $config = table(["tsv"] = "T")];
|
|
##!
|
|
|
|
module LogAscii;
|
|
|
|
export {
|
|
## If true, output everything to stdout rather than
|
|
## into files. This is primarily for debugging purposes.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const output_to_stdout = F &redef;
|
|
|
|
## If true, the default will be to write logs in a JSON format.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const use_json = F &redef;
|
|
|
|
## If true, detect log files that did not get properly rotated
|
|
## by a previous Zeek process (e.g. due to crash) and rotate them.
|
|
##
|
|
## This requires a positive rotation interval to be configured
|
|
## to have an effect. E.g. via :zeek:see:`Log::default_rotation_interval`
|
|
## or the *interv* field of a :zeek:see:`Log::Filter`.
|
|
const enable_leftover_log_rotation = F &redef;
|
|
|
|
## If true, valid UTF-8 sequences will pass through unescaped and be
|
|
## written into logs.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const enable_utf_8 = T &redef;
|
|
|
|
## Define the gzip level to compress the logs. If 0, then no gzip
|
|
## compression is performed. Enabling compression also changes
|
|
## the log file name extension to include the value of
|
|
## :zeek:see:`LogAscii::gzip_file_extension`.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const gzip_level = 0 &redef;
|
|
|
|
## Define the file extension used when compressing log files when
|
|
## they are created with the :zeek:see:`LogAscii::gzip_level` option.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const gzip_file_extension = "gz" &redef;
|
|
|
|
## Format of timestamps when writing out JSON. By default, the JSON
|
|
## formatter will use double values for timestamps which represent the
|
|
## number of seconds from the UNIX epoch.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const json_timestamps: JSON::TimestampFormat = JSON::TS_EPOCH &redef;
|
|
|
|
## Handling of optional fields when writing out JSON. By default the
|
|
## JSON formatter skips key and val when the field is absent. Setting
|
|
## the following field to T includes the key, with a null value.
|
|
const json_include_unset_fields = F &redef;
|
|
|
|
## If true, include lines with log meta information such as column names
|
|
## with types, the values of ASCII logging options that are in use, and
|
|
## the time when the file was opened and closed (the latter at the end).
|
|
##
|
|
## If writing in JSON format, this is implicitly disabled.
|
|
const include_meta = T &redef;
|
|
|
|
## Prefix for lines with meta information.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const meta_prefix = "#" &redef;
|
|
|
|
## Separator between fields.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const separator = Log::separator &redef;
|
|
|
|
## Separator between set elements.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const set_separator = Log::set_separator &redef;
|
|
|
|
## String to use for empty fields. This should be different from
|
|
## *unset_field* to make the output unambiguous.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const empty_field = Log::empty_field &redef;
|
|
|
|
## String to use for an unset &optional field.
|
|
##
|
|
## This option is also available as a per-filter ``$config`` option.
|
|
const unset_field = Log::unset_field &redef;
|
|
}
|