On another topic triggered by working on zst, I would like to figure out what we do with sets. They come from zeek and show up in the brim app, but we've only ever seen single-type sets and the spec currently says must be 1, in conflict with zeek's generality. e.g., I think you could declare
set[string,int]
in zeek then say
1 in [["foo",2],["bar",1]]
and this would be true (maybe). Certainly you could say
["foo",2] in [["foo",2],["bar",1]]
If we got rid of from the set typedef spec, then we could by future-proofed by knowing if we really had to someday map a zeek multi-typed set, we could do so with a type alias
zeek_mset0=set[record[c0:type0,c1:type1,...]]
and the app could even hide the dummy column names in the UI because it knows it's funky type alias. And if you really put set[record[]] in the zng, then the UI could display as is. I'm guessing this will never need to be done so I like this approach. Specfically, the proposal is to simplify the set typedef encodinig by getting rid of the field...
mccanne
commented
4 years ago
On another topic triggered by working on zst, I would like to figure out what we do with sets. They come from zeek and show up in the brim app, but we've only ever seen single-type sets and the spec currently says must be 1, in conflict with zeek's generality. e.g., I think you could declare
set[string,int]
in zeek then say
1 in [["foo",2],["bar",1]]
and this would be true (maybe). Certainly you could say
["foo",2] in [["foo",2],["bar",1]]
If we got rid of from the set typedef spec, then we could by future-proofed by knowing if we really had to someday map a zeek multi-typed set, we could do so with a type alias
zeek_mset0=set[record[c0:type0,c1:type1,...]]
and the app could even hide the dummy column names in the UI because it knows it's funky type alias. And if you really put set[record[]] in the zng, then the UI could display as is. I'm guessing this will never need to be done so I like this approach. Specfically, the proposal is to simplify the set typedef encodinig by getting rid of the field...
https://github.com/brimsec/zq/blob/zst/zng/docs/spec.md#3113-set-typedef