# \#558: /topic/gilbert/ascii-header

**URL:** <https://community.zeek.org/t/558-topic-gilbert-ascii-header/1988>\
**Category:** Development\
**Tags:** development\
**Created:** [August 15, 2011, 4:10pm UTC](https://community.zeek.org/t/558-topic-gilbert-ascii-header/1988 "2011-08-15T16:10:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\
**Post date:** [August 15, 2011, 4:10pm UTC](https://community.zeek.org/t/558-topic-gilbert-ascii-header/1988/1 "2011-08-15T16:10:51Z")

</div>

> &nbsp;&nbsp;- Good idea to record the field separator as well. But for non-printable  
> &nbsp;&nbsp;characters (like the default tab) it looks a bit odd, and the enclosing  
> &nbsp;&nbsp;`'...'` are somewhat tricky to parse as well. How about ``# separator  
> &nbsp;&nbsp;\t``, with whitespace separating the two and the separator itself having  
> &nbsp;&nbsp;non-printable characters escaped. Note though that (1) I'm not sure  
> &nbsp;&nbsp;whether it should be ``\t`` or for consistency ``\x09``, and (2) whether  
> &nbsp;&nbsp;either of these can be easily converted back into the binary form in awk.

I don't like using whitespace here. If the remainder of the file uses tabs, that's a mix of two whitespace characters :-(. How about using a colon?  
separator:\x09

With my darwin awk the following works:  
&nbsp;&nbsp;&nbsp;&nbsp;awk 'BEGIN { FS="\x09" }

> &nbsp;&nbsp;Other ideas?  
> &nbsp;&nbsp;- What's the use case for including the path?

Maybe "path" is misleading. Could try with "log" or "file" instead.

> &nbsp;&nbsp;- I'm wondering whether we should make it easy to tell what kind of meta-  
> &nbsp;&nbsp;line it is. How about this format:  
> &nbsp;&nbsp;{{{  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#fields ts uid id.orig\_h id.orig\_p ...  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#types time string addr port ...  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#separator \t  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#path conn  
> &nbsp;&nbsp;}}}

ACK.

cu  
Gregor

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/558-topic-gilbert-ascii-header/1988/2 "2022-05-06T15:39:46Z")

</div>