search

brimdata / super

A novel data lake based on super-structured data
https://zed.brimdata.io/
BSD 3-Clause "New" or "Revised" License
1.39k stars 64 forks source link

Suricata eve.json format conversion #1213

Closed henridf closed 4 years ago

henridf commented 4 years ago

Design and implement the means by which suricata's json alerts from the eve.json output file will be converted into zng. The solution will likely involve something à la types.json, but if some other approach turns out to be simpler/faster, let's not exclude it off the bat.

henridf commented 4 years ago

Figuring out how to handle the timestamp location (Suricata puts them in a field named timestamp) is related to this but is part of https://github.com/brimsec/zq/issues/1028.