Bro/Zeek Logging Framework for Python¶
Table of Contents¶
- Dumpers
- Loaders
- Data Model
- Data Types
- Typing Annotations
- Data Classes
- Exceptions & Warnings
- Internal Auxiliary Functions
- Enum Namespace
- Module Contents
- Namespaces
Broker
NamespaceCluster
NamespaceDCE_RPC
NamespaceHTTP
NamespaceInput
NamespaceIntel
NamespaceJSON
NamespaceKnown
NamespaceLoadBalancing
NamespaceLog
NamespaceMOUNT3
NamespaceMQTT
NamespaceNFS3
NamespaceNetControl
NamespaceNotice
NamespaceOpenFlow
NamespaceProtocolDetector
NamespaceReporter
NamespaceSMB
NamespaceSOCKS
NamespaceSSL
NamespaceSignatures
NamespaceSoftware
NamespaceSumStats
NamespaceTunnel
NamespaceWeird
NamespaceZeekygenExample
Namespacezeek
Namespace
Module Contents¶
Bro/Zeek logging framework.
-
zlogging.
write
(data, filename, format, *args, **kwargs) Write Bro/Zeek log file.
- Parameters
data (
Iterable
ofModel
) – Log records as anIterable
ofModel
per line.filename (os.PathLike) – Log file name.
format (str) – Log format.
*args – See
write_json()
andwrite_ascii()
for more information.**kwargs – See
write_json()
andwrite_ascii()
for more information.
- Raises
WriterFormatError – If
format
is not supported.
-
zlogging.
dump
(data, file, format, *args, **kwargs) Write Bro/Zeek log file.
- Parameters
data (
Iterable
ofModel
) – Log records as anIterable
ofModel
per line.format (str) – Log format.
file (_io.TextIOWrapper) – Log file object opened in text mode.
*args – See
dump_json()
anddump_ascii()
for more information.**kwargs – See
dump_json()
anddump_ascii()
for more information.
- Raises
WriterFormatError – If
format
is not supported.
-
zlogging.
dumps
(data, format, *args, **kwargs) Write Bro/Zeek log string.
- Parameters
data (
Iterable
ofModel
) – Log records as anIterable
ofModel
per line.format (str) – Log format.
*args – See
dumps_json()
anddumps_ascii()
for more information.**kwargs – See
dumps_json()
anddumps_ascii()
for more information.
- Raises
WriterFormatError – If
format
is not supported.
-
zlogging.
parse
(filename, *args, **kwargs) Parse Bro/Zeek log file.
- Parameters
filename (os.PathLike) – Log file name.
*args – See
parse_json()
andparse_ascii()
for more information.**kwargs – See
parse_json()
andparse_ascii()
for more information.
- Returns
The parsed JSON log data.
- Raises
ParserError – If the format of the log file is unknown.
- Return type
-
zlogging.
load
(file, *args, **kwargs) Parse Bro/Zeek log file.
- Parameters
file (_io.BufferedReader) – Log file object opened in binary mode.
*args – See
load_json()
andload_ascii()
for more information.**kwargs – See
load_json()
andload_ascii()
for more information.
- Returns
The parsed JSON log data.
- Raises
ParserError – If the format of the log file is unknown.
- Return type
-
zlogging.
loads
(data, *args, **kwargs) Parse Bro/Zeek log string.
- Parameters
data (AnyStr) – Log string as binary or encoded string.
*args – See
loads_json()
andloads_ascii()
for more information.**kwargs – See
loads_json()
andloads_ascii()
for more information.
- Returns
The parsed JSON log data.
- Raises
ParserError – If the format of the log file is unknown.
- Return type
-
class
zlogging.
Model
(*args, **kwargs) Bases:
object
Log data model.
- Variables
__fields__ (
OrderedDict
mappingstr
andBaseType
) – Fields of the data model.__record_fields__ (
OrderedDict
mappingstr
andRecordType
) – Fields ofrecord
data type in the data model.__empty_field__ (bytes) – Placeholder for empty field.
__unset_field__ (bytes) – Placeholder for unset field.
__set_separator__ (bytes) – Separator for set/vector fields.
- Warns
BroDeprecationWarning – Use of
bro_*
type annotations.- Raises
ModelValueError – In case of inconsistency between field data types, or values of
unset_field
,empty_field
andset_separator
.ModelTypeError – Wrong parameters when initialisation.
Note
Customise the
Model.__post_init__
method in your subclassed data model to implement your own ideas.Example
Define a custom log data model using the prefines Bro/Zeek data types, or subclasses of
BaseType
:class MyLog(Model): field_one = StringType() field_two = SetType(element_type=PortType)
Or you may use type annotations as PEP 484 introduced when declaring data models. All available type hints can be found in
typing
:class MyLog(Model): field_one: zeek_string field_two: zeek_set[zeek_port]
However, when mixing annotations and direct assignments, annotations will take proceedings, i.e. the
Model
class shall process first annotations then assignments. Should there be any conflicts,ModelError
will be raised.See also
See
_aux_expand_typing()
for more information about processing the fields.-
property
fields
OrderedDict
mappingstr
andBaseType
: fields of the data model
-
property
unset_field
bytes: placeholder for empty field
-
property
empty_field
bytes: placeholder for unset field
-
property
set_separator
bytes: separator for set/vector fields
-
__post_init__
() Post-processing customisation.
-
__call__
(format) Serialise data model with given format.
- Parameters
format (str) – Serialisation format.
- Returns
The serialised data.
- Raises
ModelFormatError – If
format
is not supproted, i.e.Mode.to{format}()
does not exist.- Return type
Any
-
tojson
() Serialise data model as JSON log format.
- Returns
An
OrderedDict
mapping each field and serialised JSON serialisable data.- Return type
OrderedDict[str, Any]
-
toascii
() Serialise data model as ASCII log format.
- Returns
An
OrderedDict
mapping each field and serialised text data.- Return type
OrderedDict[str, str]
-
asdict
(dict_factory=None) Convert data model as a dictionary mapping field names to field values.
- Parameters
dict_factory (Optional[type]) – If given,
dict_factory
will be used instead of built-indict
.- Returns
A dictionary mapping field names to field values.
- Return type
Dict[str, Any]
-
astuple
(tuple_factory=None) Convert data model as a tuple of field values.
- Parameters
tuple_factory (Optional[type]) – If given,
tuple_factory
will be used instead of built-intuple
.- Returns
A tuple of field values.
- Return type
Tuple[Any]
-
zlogging.
new_model
(name, **fields) Create a data model dynamically with the appropriate fields.
- Parameters
name (str) – data model name
**fields – defined fields of the data model
Any] fields (Dict[str,) –
- Returns
created data model
- Return type
Model
Examples
Typically, we define a data model by subclassing the
Model
class, as following:class MyLog(Model): field_one = StringType() field_two = SetType(element_type=PortType)
when defining dynamically with
new_model()
, the definition above can be rewrote to:MyLog = new_model('MyLog', field_one=StringType(), field_two=SetType(element_type=PortType))
-
class
zlogging.
AddrType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
addr
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, ipaddress.IPv4Address, ipaddress.IPv6Address]) – raw data
- Returns
The parsed IP address. If
data
is unset,None
will be returned.- Return type
Union[None, ipaddress.IPv4Address, ipaddress.IPv6Address]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, ipaddress.IPv4Address, ipaddress.IPv6Address]) – raw data
- Returns
The JSON serialisable IP address string.
- Return type
str
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, ipaddress.IPv4Address, ipaddress.IPv6Address]) – raw data
- Returns
The ASCII representation of the IP address.
- Return type
str
-
class
zlogging.
BoolType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
bool
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, bool]) – raw data
- Returns
The parsed boolean data. If
data
is unset,None
will be returned.- Raises
ZeekValueError – If
data
is NOT unset and NOTT
(True
) norF
(False
) in Bro/Zeek script language.- Return type
Union[None, bool]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, bool]) – raw data
- Returns
The JSON serialisable boolean data.
- Return type
Union[None, bool]
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, bool]) – raw data
- Returns
T
ifTrue
,F
ifFalse
.- Return type
str
-
class
zlogging.
CountType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
count
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, ctypes.c_ulong]) – raw data
- Returns
The parsed numeral data. If
data
is unset,None
will be returned.- Return type
Union[None, ctypes.c_ulong]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, ctypes.c_ulong]) – raw data
- Returns
The JSON serialisable numeral data.
- Return type
int
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, ctypes.c_ulong]) – raw data
- Returns
The ASCII representation of numeral data.
- Return type
str
-
class
zlogging.
DoubleType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
double
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, decimal.Decimal]) – raw data
- Returns
The parsed numeral data. If
data
is unset,None
will be returned.- Return type
Union[None, decimal.Decimal]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, decimal.Decimal]) – raw data
- Returns
The JSON serialisable numeral data.
- Return type
float
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, decimal.Decimal]) – raw data
- Returns
The ASCII representation of numeral data.
- Return type
str
-
class
zlogging.
EnumType
(empty_field=None, unset_field=None, set_separator=None, namespaces=None, bare=False, enum_hook=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
enum
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.namespaces (
List[str]
, optional) – Namespaces to be loaded.bare (
bool
, optional) – IfTrue
, do not loadzeek
namespace by default.enum_hook (
dict
mapping ofstr
andenum.Enum
, optional) – Additional enum to be included in the namespace.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.enum_namespaces (
dict
mappingstr
andenum.Enum
) – Global namespace forenum
data type.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, enum.Enum]) – raw data
- Returns
The parsed enum data. If
data
is unset,None
will be returned.- Warns
ZeekValueWarning – If
date
is not defined in the enum namespace.- Return type
Union[None, enum.Enum]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, enum.Enum]) – raw data
- Returns
The JSON serialisable enum data.
- Return type
str
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, enum.Enum]) – raw data
- Returns
The ASCII representation of the enum data.
- Return type
str
-
class
zlogging.
IntervalType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
interval
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, datetime.timedelta]) – raw data
- Returns
The parsed numeral data. If
data
is unset,None
will be returned.- Return type
Union[None, datetime.timedelta]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, datetime.timedelta]) – raw data
- Returns
The JSON serialisable numeral data.
- Return type
int
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, datetime.timedelta]) – raw data
- Returns
The ASCII representation of numeral data.
- Return type
str
-
class
zlogging.
IntType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
int
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, ctypes.c_long]) – raw data
- Returns
The parsed numeral data. If
data
is unset,None
will be returned.- Return type
Union[None, ctypes.c_long]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, ctypes.c_long]) – raw data
- Returns
The JSON serialisable numeral data.
- Return type
int
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, ctypes.c_long]) – raw data
- Returns
The ASCII representation of numeral data.
- Return type
str
-
class
zlogging.
PortType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
port
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, ctypes.c_ushort]) – raw data
- Returns
The parsed port number. If
data
is unset,None
will be returned.- Return type
Union[None, ctypes.c_ushort]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, ctypes.c_ushort]) – raw data
- Returns
The JSON serialisable port number string.
- Return type
int
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, ctypes.c_ushort]) – raw data
- Returns
The ASCII representation of the port number.
- Return type
str
-
class
zlogging.
RecordType
(empty_field=None, unset_field=None, set_separator=None, *args, **element_mapping) Bases:
zlogging.types._VariadicType
Bro/Zeek
record
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – element_mapping (
dict
mappingstr
andBaseType
instance): Data type of container’s elements.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.element_mapping (
dict
mappingstr
andBaseType
instance) – Data type of container’s elements.
- Raises
ZeekTypeError – If
element_mapping
is not supplied.ZeekValueError – If
element_mapping
is not a valid Bro/Zeek data type; or in case of inconsistency fromempty_field
,unset_field
andset_separator
of each field.
Note
A valid
element_mapping
should be a simple or generic data type, i.e. a subclass of_SimpleType
or_GenericType
.See also
See
_aux_expand_typing()
for more information about processing the fields.-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
class
zlogging.
SetType
(empty_field=None, unset_field=None, set_separator=None, element_type=None, *args, **kwargs) Bases:
zlogging.types._GenericType
,typing.Generic
Bro/Zeek
set
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.element_type (
BaseType
instance) – Data type of container’s elements.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.element_type (
BaseType
instance) – Data type of container’s elements.
- Raises
ZeekTypeError – If
element_type
is not supplied.ZeekValueError – If
element_type
is not a valid Bro/Zeek data type.
Example
As a generic data type, the class supports the typing proxy as introduced PEP 484:
>>> SetType[StringType]
which is the same at runtime as following:
>>> SetType(element_type=StringType())
Note
A valid
element_type
should be a simple data type, i.e. a subclass of_SimpleType
.-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, Set[data]]) – raw data
- Returns
The parsed set data. If
data
is unset,None
will be returned.- Return type
Union[None, Set[data]]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, Set[data]]) – raw data
- Returns
The JSON serialisable set data.
- Return type
list
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, Set[data]]) – raw data
- Returns
The ASCII representation of the set data.
- Return type
str
-
class
zlogging.
StringType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
string
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, memoryview, bytearray]) – raw data
- Returns
The parsed string data. If
data
is unset,None
will be returned.- Return type
Union[None, ByteString]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, ByteString]) – raw data
- Returns
The JSON serialisable string data encoded in ASCII.
- Return type
str
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, ByteString]) – raw data
- Returns
The ASCII encoded string data.
- Return type
str
-
class
zlogging.
SubnetType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
subnet
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, ipaddress.IPv4Network, ipaddress.IPv6Network]) – raw data
- Returns
The parsed IP network. If
data
is unset,None
will be returned.- Return type
Union[None, ipaddress.IPv4Network, ipaddress.IPv6Network]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, ipaddress.IPv4Network, ipaddress.IPv6Network]) – raw data
- Returns
The JSON serialisable IP network string.
- Return type
str
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, ipaddress.IPv4Network, ipaddress.IPv6Network]) – raw data
- Returns
The ASCII representation of the IP network.
- Return type
str
-
class
zlogging.
TimeType
(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs) Bases:
zlogging.types._SimpleType
Bro/Zeek
time
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.
-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, datetime.datetime]) – raw data
- Returns
The parsed numeral data. If
data
is unset,None
will be returned.- Return type
Union[None, datetime.datetime]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, datetime.datetime]) – raw data
- Returns
The JSON serialisable numeral data.
- Return type
int
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, datetime.datetime]) – raw data
- Returns
The ASCII representation of numeral data.
- Return type
str
-
class
zlogging.
VectorType
(empty_field=None, unset_field=None, set_separator=None, element_type=None, *args, **kwargs) Bases:
zlogging.types._GenericType
,typing.Generic
Bro/Zeek
vector
data type.- Parameters
empty_field (
bytes
orstr
, optional) – Placeholder for empty field.unset_field (
bytes
orstr
, optional) – Placeholder for unset field.set_separator (
bytes
orstr
, optional) – Separator forset
/vector
fields.element_type (
BaseType
instance) – Data type of container’s elements.*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.
- Variables
empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for
set
/vector
fields.element_type (
BaseType
instance) – Data type of container’s elements.
- Raises
ZeekTypeError – If
element_type
is not supplied.ZeekValueError – If
element_type
is not a valid Bro/Zeek data type.
Example
As a generic data type, the class supports the typing proxy as introduced PEP 484:
>>> VectorType[StringType]
which is the same at runtime as following:
>>> VectorType(element_type=StringType())
Note
A valid
element_type
should be a simple data type, i.e. a subclass of_SimpleType
.-
property
python_type
type: Corresponding Python type annotation.
-
property
zeek_type
str: Corresponding Zeek type name.
-
parse
(data) Parse
data
from string.- Parameters
data (Union[AnyStr, List[data]]) – raw data
- Returns
The parsed list data. If
data
is unset,None
will be returned.- Return type
Union[None, List[data]]
-
tojson
(data) Serialize
data
as JSON log format.- Parameters
data (Union[None, List[data]]) – raw data
- Returns
The JSON serialisable list data.
- Return type
list
-
toascii
(data) Serialize
data
as ASCII log format.- Parameters
data (Union[None, List[data]]) – raw data
- Returns
The ASCII representation of the list data.
- Return type
str