It would be very helpful if all of the logs started with the connection tuple to make parsing easier.

We're trying to avoid relying on the order of fields. The recommended way is to parse the header and then index columns by their names. While using columns directly would be easier of course, it makes it hard to change a log's content in the future. Robin

#718: Log protocol type for notices

Development

Topic		Replies	Views
Call for opinions on logging framework syntax problem Development development	18	176	December 2, 2011
Conn Log Zeek	1	124	November 11, 2016
conn.bro Development development	5	120	May 4, 2011
fields in the conn.log Zeek	0	168	July 27, 2005
Log an Arbitrarily Long Collection Zeek	5	105	September 13, 2013

#718: Log protocol type for notices

Related topics