Convert eve.json upon ingest #1400
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
henridf
force-pushed
the
eve-json-ingest
branch
from
3e7d710
to
7fab38b
Compare
henridf
commented
Sep 30, 2020
henridf
force-pushed
the
eve-json-ingest
branch
from
7fab38b
to
8a1ee44
Compare
henridf
force-pushed
the
eve-json-ingest
branch
from
8a1ee44
to
7d410a0
Compare
mattnibs
reviewed
Oct 2, 2020
mattnibs
approved these changes
Oct 5, 2020
brim-bot
pushed a commit
to brimdata/zui
that referenced
this pull request
Oct 5, 2020
This is an auto-generated commit with a zq dependency update. The zq PR brimdata/super#1400, authored by @henridf, has been merged. Convert eve.json upon ingest This PR adds a json type config that is suited for "alert" events output by the Brim suricata package. The config is used when transforming the Suricata-produced "eve.json" file. In addition, the suricata `timestamp` field is renamed to `ts`. This PR is based on brimdata/super#1389 so if you come here first, please try to make the detour. Closes brimdata/super#1213
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a json type config that is suited for "alert" events output by the Brim suricata package. The config is used when transforming the Suricata-produced "eve.json" file. In addition, the suricata
timestampfield is renamed tots.This PR is based on #1389 so if you come here first, please try to make the detour.
Closes #1213