Hello There,
I have some data that is delimited by a comma, but the data length could vary in between. For example:
- A,B,C,D,E
- AA,BBB,C,DDDDD,EE
- AAA,BB,CCCCCCCC,DD,EEE
I was thinking of using bytestring inside the record and have it read until each delimiter… something like…
type My_Data = record {
field1 : bytestring & length=readuntil 0x2c;
field2 : bytestring & length=readuntil 0x2c;
field3 : bytestring & length=readuntil 0x2c;
field4 : bytestring & length=readuntil 0x2c;
field1 : bytestring &restofdata;
};
Does this feature exist in Bro? I vaguely remember seeing a readuntil feature for Bro, but can’t pull up the exact info.
Thanks,