phaag / nfdump

Netflow processing tools
Other
781 stars 206 forks source link

Undesired spaces in output #78

Closed Kolano closed 6 years ago

Kolano commented 6 years ago

Using nfdump with a custom format, such as... nfdump -R /var/cache/nfdump/ -o "fmt:'%ts', '%te', '%td', '%sa', '%da', '%sp', '%dp', '%pr', '%byt', '%pkt', '%fl', '%flg', %ibyt, %obyt)," -a -q -6 ...results in output like...

'2017-10-20 16:17:46.872', '2017-10-20 16:19:36.847',   109.975, '                          23.205.209.68', '                           192.168.0.35',     80, ' 56539', 'TCP  ', '    2650', '       6', '    2', '.AP.SF',     2650,        0),
'2017-10-20 16:18:57.044', '2017-10-20 16:18:57.044',     0.000, '                           192.168.0.35', '                          51.174.223.78',  61989, '  8999', 'UDP  ', '     134', '       1', '    1', '......',      134,        0),

...where spaces used to align columns are included in each %XXX field rather than adjoining them.

Those spaces should be output separately from the data points and/or options provided to not make use of them.

binarzero commented 6 years ago

it's possible to modify the output by adding your own output formatter, it does take some work but ultimately it's worth it, i can give you some pointers if you wish.

Kolano commented 6 years ago

Thanks, that would be appreciated. I'm generating SQL output, and currently have to push everything through trim() calls to clean things up.

phaag commented 6 years ago

The output formater uses these spaces for display reason. I perfectly understand, that postprocessing the data requires trimming spaces. I would rather like to add json output format to nfdump rather than having a trim option for each and every field. For the time being, please postprocess the output and trim the space.

Kolano commented 6 years ago

Wasn't asking for many individual options, just a single one to omit the indentation spaces from output.

Kolano commented 6 years ago

Is there any documentation on "adding your own output formatter"?