There was a post recently on the Zeek mailing list that referenced Avro, which led us to consider chiming in to mention the applicability of zinger. However, zinger hasn't been touched in a while, so @mccanne made the valid point that it it should be updated to point to a recent zq and make sure the demo workflow still works correctly.
With help from @aswan, in this branch we've now got:
zinger pointed to a recent tagged zq release
zinger is updated to work with recent ZNG typing changes
I've re-tested it working end-to-end with with kavro-demo using both Zeek and JSON log inputs
@aswan got it working well enough to handle all the Zeek types, though there's still some ZNG-only types it doesn't cover. Since we're only claiming prototype quality and our primary motivation right now is to have it ready for Zeek users to tinker with it, I've added a bullet to the caveats list. Once this is merged, I can open a reminder issue for us to circle back and catch up to full ZNG compatibility at a later date.
There was a post recently on the Zeek mailing list that referenced Avro, which led us to consider chiming in to mention the applicability of
zinger. However, zinger hasn't been touched in a while, so @mccanne made the valid point that it it should be updated to point to a recentzqand make sure the demo workflow still works correctly.With help from @aswan, in this branch we've now got:
zqrelease@aswan got it working well enough to handle all the Zeek types, though there's still some ZNG-only types it doesn't cover. Since we're only claiming prototype quality and our primary motivation right now is to have it ready for Zeek users to tinker with it, I've added a bullet to the caveats list. Once this is merged, I can open a reminder issue for us to circle back and catch up to full ZNG compatibility at a later date.