The ZSON in question was produced from an updated version of the Zeek NDJSON reference shaper I've been working on. Here's a simplified version shaper.zed that reproduces the problem:
type port=uint16
type zenum=string
type conn_id={orig_h:ip,orig_p:port,resp_h:ip,resp_p:port}
type conn={_path:string,ts:time,uid:string,id:conn_id,proto:zenum,service:string,duration:duration,orig_bytes:uint64,resp_bytes:uint64,conn_state:string,local_orig:bool,local_resp:bool,missed_bytes:uint64,history:string,orig_pkts:uint64,orig_ip_bytes:uint64,resp_ip_bytes:uint64,tunnel_parents:|[string]|,_write_ts:time}
yield nest_dotted(this)
| yield {_original: this, _shaped: shape(conn)}
| put _cropped := crop(_shaped, conn)
| switch (_cropped == _shaped) (
case true => yield _shaped
case false => yield error({msg: "shaper error: fields were cropped", _original, _shaped, _cropped})
)
The following conn.ndjson can be used as input data.
I intentionally dropped the resp_pkts field in the conn type definition, so putting it all together I get the expected error value that includes embedded records.
tl;dr
The attached conn.zson.gz that was previously output by
zq
produces the following error when read:Details
Repro is with Zed commit d1a78b8.
The ZSON in question was produced from an updated version of the Zeek NDJSON reference shaper I've been working on. Here's a simplified version
shaper.zed
that reproduces the problem:The following
conn.ndjson
can be used as input data.I intentionally dropped the
resp_pkts
field in theconn
type definition, so putting it all together I get the expectederror
value that includes embedded records.However,
zq
refuses to read back that ZSON.